Trust Portal
Welcome to Beam's Trust Portal
We value the confidence our customers place in us to store, process, and protect your information. Our commitment to data privacy and security is essential to every part of our business.
Use this Trust Portal to learn about our security posture and request access to our security documentation.
Data Processing and Subprocessors
- How quickly is a leaver's access to systems and customer data removed?
- Who at Beam can access our data, and how is that controlled?
- Where is data stored?
- When does Beam's SOC 2 report expire, and what period does it cover?
- How does Beam handle a subject access request, or any other data subject rights request, about our data?
Trust Portal Updates
PHP Security Incident
PHP Security Incident: Beam’s Response
No impact to Beam
On 21 October 2026 the PHP project released emergency fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619 (together known as PHP2Shell, CVSS 9.2), which allow unauthenticated remote code execution on web servers running affected versions. Exploitation has since been observed in the wild, and on 23 October PHP disclosed a third, lower-risk issue (CVE-2026-115560) that is not yet patched. Several customers have asked whether Beam is exposed. This statement sets out our position.
Beam is not affected, as our application is built on Ruby on Rails and runs on Google Cloud Run, so there is no PHP runtime anywhere in our application or hosting stack. That means there is no PHP version or patch level to report, and no exposure to the vulnerability in our environment.
We have found no evidence of compromise, and your data is not affected. We have also assessed each of our sub-processors and there is no evidence that any of them have been affected by these vulnerabilities. If you’d like to see the third-party sub-processors we work with, they are listed at trust.beam.org.
Please let us know if you have any further questions.
Stuart Murray
Chief Information Risk Officer
Beam