Purpose
Protecting participant information and maintaining the integrity of the Companion are essential parts of respecting the people who choose to use been.
This document describes the technical and operational safeguards currently implemented within the Companion. It also explains the principles that guide our approach to security and acknowledges areas where future development may strengthen the system.
Security is not treated as a separate technical concern. It forms part of the ethical responsibility to provide a trustworthy environment for reflection.
Security Principles
The Companion is designed to support participant trust through principles that include:
- protecting participant information from unauthorized access;
- limiting access to information wherever reasonably possible;
- using recognized security practices appropriate to the current implementation;
- maintaining transparency about how information is protected;
- reviewing security measures as the Companion evolves.
No security measure can eliminate every possible risk. Our commitment is to apply reasonable safeguards, continuously review the implementation, and respond responsibly as the system develops.
Current Technical Infrastructure
At the time of publication, been is implemented as a secure web application using managed cloud infrastructure.
The current implementation includes:
- managed authentication services;
- a managed PostgreSQL database;
- secure HTTPS communication;
- server-side AI processing;
- managed cloud hosting;
- controlled access to participant data through application-level permissions.
Authentication
Participant accounts are protected through managed authentication services.
The current implementation includes:
- email and password authentication;
- authenticated sessions using secure access tokens;
- server-side validation of authenticated requests before protected resources are accessed.
Data Protection
Participant information is protected through multiple layers of security.
The current implementation includes:
- encrypted communication between participants and the application using HTTPS;
- encryption provided by the managed cloud infrastructure for stored data;
- row-level access controls that restrict participants to their own conversations and information;
- server-side validation before protected data is accessed.
Access Controls
Access to participant information is intentionally restricted.
Participants can access only the information associated with their own account through application-level permissions.
Administrative access is limited to authorized project administrators responsible for maintaining and operating the Companion.
No participant can access another participant's conversations through the normal operation of the application.
AI Infrastructure
AI responses are generated through a managed AI service using secure server-side communication.
Participant messages required to generate a response are transmitted securely to the AI provider through the application's server infrastructure.
The Companion does not maintain cross-conversation memory. AI requests include only the current conversation history necessary to generate an appropriate response.
Security Monitoring
Security is reviewed throughout the development of the Companion.
At the current pilot stage, the implementation relies primarily on platform-managed security features and application-level safeguards.
Additional monitoring, auditing, and operational controls may be introduced as the Companion evolves beyond the pilot phase.
Backup and Recovery
The Companion relies on the managed database infrastructure provided by its hosting environment.
The application itself does not currently implement a separate backup or disaster recovery system beyond the services provided by the managed platform.
Continuous Improvement
Security is reviewed as part of the ongoing governance of been.
As the Companion evolves, security practices may be revised in response to:
- technological developments;
- emerging security risks;
- legal or regulatory requirements;
- research findings;
- operational experience.
Meaningful changes will be reflected through version-controlled governance documentation.
Conclusion
Security is more than protecting systems. It is part of protecting the trust placed in the Companion.
Our commitment is to maintain security measures that are proportionate to the Companion's purpose, transparent about their limitations, and continuously reviewed as been develops.