Security and data privacy

Where the data lives

All your data is stored and processed in Stockholm. The database runs in AWS region eu-north-1 and the server functions in Vercel's arn1 region. The processing takes place under GDPR.

That was a deliberate choice. It means shorter response times for those of you based here, and a simple answer the day a customer asks where her details end up.

There are a few exceptions you should know about. What Belle passes on to the AI provider has names and personal data replaced with aliases, but it may be processed outside the EU. When we read text out of a scanned document, the document's text is sent as it is, unmasked. And if you connect Bellebook to the Google calendar or to Microsoft 365, the booking's details go there unmasked.

Who can see what

Your business is separated from every other business on the platform. That separation is built in three independent layers, and we have verified it against the live database:

• Identity comes from the login, never from the browser. Nobody can ask for someone else's data by rewriting an address.
• Every protected service checks ownership before it reads or writes anything.
• The database has row-level security on every table. Without the right business in the session, zero rows come back — closed is the default, not the exception.

Roles inside your business

Inside your own business, the role decides what a person sees. A member of staff sees their day: their schedule, their customers, the checkout on their phone. Owners and administrators see the whole picture — finances, staff, contracts.

We also limit how many requests can be made per minute. That means the login cannot be worked through with guessed codes, and a misbehaving integration cannot grind the platform down.

Belle AI and personal data

Belle is the AI that works in your own data. She reads bookings, customers and figures — but that does not mean your customer list is passed on in clear text.

In Belle's chat, names and personal data are replaced with aliases before the question leaves the platform. The key that links an alias to a person never leaves Bellebook's servers. The provider sees the pattern, not the people, and does not train its models on data that arrives through the API.

There is one exception you should know about: when we read text out of a scanned document, the document's text is sent unmasked. It is the only AI route without masking.

You still see real names in your own answers. The masking protects you from the provider — not from yourselves. It is your data.

Your rights and your customers'

GDPR gives your customers rights that you are responsible for meeting. We have built them into the product, so the answer isn't a manual trawl through five systems:

• Full data export (article 15): everything we hold about a single customer.
• Erasure (article 17): deletion or anonymisation per customer, so the accounting records remain without the person in them.
• Consents are stored per customer with the date, so you can show when someone said yes, and to what.
• Both export and erasure are written to the audit log, so it can be shown afterwards that the action was carried out.

What we have checked

In August 2026 we ran a review of the production environment: the database, the hosting, the chain that builds and ships our code, the app's protective layers and our mail domains.

The conclusion was that the foundation holds, and that what remains is about operations rather than code. Among the things confirmed: row-level security is on across the whole database, the login checks passwords against known breaches, and vulnerability scans run every day, where serious findings fail the build. Every change also passes mandatory gates — the full test suite and the security scans run — before it can be merged.

The review also produced a prioritised list of actions, and we are working through it in order. If you want to know where we stand on a particular point, email info@belleminds.ai — we will answer plainly.