Security Overview

Last Updated: November 4, 2026

This page describes the security measures Benson Technologies LLC (“Benson”) maintains for the Benson Service as of the date above. It is a description, not a certification. The Customer Agreement, the Data Protection and Security Addendum, and, where executed, the Business Associate Agreement govern.

1. HOSTING AND DATA LOCATION

The Service runs on Vercel (application) and Supabase (database and file storage). All customer data, including backups, is stored and processed only in the United States, and every provider Benson uses is located in the United States. The providers and their purposes are listed in the Subprocessor List.

2. ENCRYPTION

Traffic between users and the Service, and between the Service and its providers, is encrypted in transit with TLS. The database, file storage, and backups are encrypted at rest. Social Security numbers are encrypted a second time inside the database with a key held outside it, so the full number is readable only through the application.

3. SEPARATION BETWEEN AGENCIES

Each agency’s records are separated at the database level. A signed-in user can read and change only the records of their own agency, and the database enforces this on every request, not only the application.

4. ACCESS CONTROL

Users sign in with a username and password. The primary administrator creates roles and chooses which areas of the Service each role can see and change; users see only what their role allows. Sessions end automatically after fifteen (15) minutes without activity.

5. AUDIT LOG

Every change to an agency’s data is written to a permanent audit log that records who made the change, what changed, and when. The log cannot be edited or deleted through the Service and is kept for the life of the account. Administrators can review it in the Service.

6. BACKUPS

Benson’s database provider takes daily encrypted backups, stored in the United States and rotated within thirty (30) days. Backups are used only to recover from a system failure.

7. AUTOMATED DOCUMENT READING

When an agency turns on automatic document reading, uploaded documents are sent over TLS to Anthropic, Benson’s document-reading provider, which is contractually prohibited from using content submitted through its service to train its models. The result is stored with the document, every automated action is visible in the Service, and each one can be reversed.

8. EMAIL

Email from the Service is sent through Resend from the mail.bensonhr.com domain, which is authenticated with SPF, DKIM, and DMARC, unless the agency connects its own Microsoft 365 mailbox. A connected mailbox is used through a send-only permission: Benson never reads the mailbox, the token is stored encrypted, and it is deleted when the mailbox is disconnected.

9. ELECTRONIC SIGNATURES

For each signer, the Service records consent to sign electronically, the signer’s IP address and browser, and the time of each step, and produces a Certificate of Completion for each completed document. Signed documents and their evidence are kept for the life of the account.

10. MONITORING AND CHANGE CONTROL

Application errors are reported to Sentry, with user identity and cookies excluded from reports, so that defects are found and corrected. Dependencies are kept current, and changes are reviewed and tested before release. Benson personnel with access to production systems are bound by confidentiality obligations, and access is limited to what their role requires.

11. INCIDENT RESPONSE

Benson notifies affected customers of a confirmed security incident within seventy-two (72) hours of confirming it, and of a breach of Protected Health Information within ten (10) business days of discovery, as provided in the Data Protection and Security Addendum and the Business Associate Agreement.

12. CERTIFICATIONS

Benson has not completed a third-party audit such as SOC 2 or HITRUST and does not offer a contractual uptime commitment at this stage. This page will be updated when that changes.

13. REPORTING A VULNERABILITY

Vulnerabilities may be reported to info@bensonhr.com; Benson also publishes a security.txt file at bensonhr.com/.well-known/security.txt. Please allow Benson a reasonable time to address a report before disclosing it, and do not access, change, or delete another person’s data while testing.