Security
Security your payments team can sign off on.
Beast is SOC 2 Type II audited and GDPR and HIPAA compliant. It never receives card numbers, connects read-only by default, and never uses your data to train AI models.
Compliance
SOC 2 Type II audited. GDPR and HIPAA compliant.
SOC 2 Type II
An independent audit of Beast's security controls, tested over time.
GDPR
Personal data handled under the EU's data protection rules.
HIPAA
Safeguards for protected health information.
Access
Reads what it needs. Changes nothing on its own.
What Beast reads
- Orders, rebills and affiliates
- Decline codes, BINs, AVS and CVV results
- Settlements, fees and reserves
- Chargebacks and reason codes
What Beast never does
- Receive or store card numbers
- Process payments or hold your money
- Change your checkout
- Show AI assistants your customers' identifiers
- Use your data to train AI models
Only with Revenue boost
Off until you turn it on
Beast routes first charges and retries declines through your billing platform, and reports the lift every month. Until then, every recommendation is read-only and your team decides what to change.
How Revenue boost is pricedData protection
Your data, protected at every step.
No card numbers, ever
Beast never receives or stores card numbers. It works from BINs, the first digits that identify the card's bank, and the codes your tools record.
Encrypted in transit and at rest
Your data is encrypted on its way to Beast, on its way to you, and where it's stored.
Read-only connections
Beast reads from your tools. It can't change orders, settings or routing unless you turn on Revenue boost.
Your sign-in, your access
Every person and every AI assistant signs in with a Beast account and sees only what that account can.
Never used for training
Beast never uses your payment data to train AI models, in Beast or through its MCP server.
Guarded AI lookups
AI assistants never receive your customers' identifiers, and an order lookup returns up to 25 rows, never your whole list.
Is Beast Insights SOC 2 compliant?
Yes. Beast Insights is SOC 2 Type II audited: an independent auditor has tested its security controls over a period of time, not on a single day. Beast is also GDPR and HIPAA compliant, encrypts your data in transit and at rest, and never uses it to train AI models.
Does Beast store card numbers?
No. Beast never receives or stores card numbers. Card details stay with your gateways and processors. Beast works from what your tools already record about each payment, such as the BIN, the first digits that identify the card's bank, and the decline and reason codes, so no card number ever reaches Beast.
Does Beast change anything in my payment setup?
Not unless you turn on Revenue boost. By default Beast connects read-only: it reads orders, declines, chargebacks and settlements, recommends what to change, and your team decides. With Revenue boost on, Beast routes first charges and retries declines through your billing platform, and reports the lift every month.
Is Beast a payment processor?
No. Beast never processes payments or holds your money. Your charges still run through your own billing platform, gateways and processors, with no change to your checkout. Beast reads what those tools record to show where approvals and revenue are lost, and routes through your billing platform only if you turn on Revenue boost.
Is my payment data used to train AI models?
No. Beast never uses customer data to train AI models. Beast AI answers from your own data inside your Beast account, and AI assistants connected through Beast's MCP server get only what your Beast sign-in allows, read-only, with your customers' identifiers withheld.
Is my data encrypted?
Yes. Your data is encrypted in transit, on its way from your tools to Beast and from Beast to you, and at rest, where it's stored. Every person and every AI assistant signs in with a Beast account and sees only what that account can, so access stays tied to a login you control.
Is Beast GDPR and HIPAA compliant?
Yes. Beast is compliant with GDPR, the EU's data protection law, and with HIPAA, the US rules for protected health information, which matter to merchants such as telehealth subscriptions. Both sit alongside Beast's SOC 2 Type II audit, which tests the security controls that protect every merchant's data.
Can an AI assistant see my customers through Beast?
No. Claude, ChatGPT and other assistants connect through Beast's MCP server with a Beast sign-in, read-only. Your customers' identifiers are withheld, and an order lookup needs at least one filter and returns up to 25 rows. You can remove an assistant's access any time from its connector settings.
Further reading