SECURITY AND RECORDS GOVERNANCEInformation
is protected from
its organisation.
Beeblos relates companies, users, applications and documents through defined access scopes. Security covers both the work of people and the connection between systems.
MULTI-COMPANY ORGANISATION
Beeblos
Company A
AdministrationAgreements · Invoices
OperationsReports · Deliveries
Repositories and permissions of company A
Company B
AdministrationAgreements · Invoices
ProjectsCase files · Reports
Repositories and permissions of company B
Define who accesses information
and what they can do with it.
01 / PEOPLE
How do people access it?
User access is organised through accounts and sessions linked to the company and to their responsibilities. Managing users and organisational units places each person within their area of work.
Identity and sessions
The web interface uses a user session. Internal calls to services carry a verified identity, distinct from application identities.
In the Records architecture, the web layer issues tokens signed with ES256. Services verify the signature using public keys published as JWKS.
02 / APPLICATIONS
How do applications connect?
Each application identifies itself to the service and operates within the permissions it has been granted. The connection defines the company, the repositories and the operations it can use.
Service identities
Service connections use signed tokens and verify the issuer, the audience and the authorised scope. Public keys make it possible to confirm the identity of the calling application.
When an operation is performed on behalf of a person, the integration preserves their attribution. The application's business rules are complemented by the document service's authorisation.
03 / ORGANISATION
Who can use each document?
The multi-company organisation separates document scopes. Within each company, organisational units and their hierarchical relationships reflect departments, teams and responsibilities.
Permissions govern the retrieval and management of documents. The relationships between users, units and workspaces apply the organisation's access criteria.
Structure and authorisation
The company identity is part of the verified access context. Team permissions and the technical permissions of applications are managed according to the operations that correspond to them.
The organisational structure describes who takes part. Document classification describes how information is ordered; both dimensions are related in the solution.
04 / RETENTION
How is retention managed?
Document policies set retention periods and expiry criteria for the different kinds of documentation. Each organisation decides how they should be applied according to its obligations and activity.
Retention is tied to review responsibilities and to decisions about the life cycle of documents.
Policies and life cycle
The policy expresses the retention criterion and makes it possible to determine the expiry status. Review and disposition procedures are defined as part of the records governance of each implementation.
DATA PROTECTION AND SECURITY FRAMEWORKS
Controls to apply the policies
of your organisation.
Regulatory requirements take shape as technical measures, procedures and responsibilities over information.
GDPR
Data protection in document management
Access control and retention criteria help apply data protection policies. The purpose of processing, responsibilities and time limits are set by each organisation.
Privacy by design · AEPD →ISO/IEC 27001
Information security management
A framework for organising risk management and security measures. The controls of the document solution should fit within the management system and the scope defined by the organisation.
About the standard · ISO →ENS
Security of information systems
In projects subject to Spain's National Security Framework (ENS), architecture and operation are specified according to the system's scope, category and applicable measures.
ENS compliance · CCN →These references describe frameworks of application. Compliance and certifications correspond to an accredited scope and are documented for the service or system they refer to.
