Security & Data Protection
Board information is sensitive. Treat it that way.
Role-based access, full audit logging, encryption in transit and at rest, and data residency options. Board records that are complete, permanent, and visible only to the people entitled to see them.
Product walkthrough
Make secure access practical for every director.
Two-factor authentication and role-based access protect the record without making the portal difficult to use.
1 of 3
BoardSite was built from the ground up with security and access control in mind. Boards have several layers of authority and information flow, and BoardSite ensures members access only what they have a “need to know.” Access can be further protected with two-factor authentication, and detailed activity logs let you see what members are doing in the system. Security documentation, including our controls summary and completed questionnaires, is available to prospective customers on request.
Flexible, secure sign-in
Members can sign in with an email and password, with optional two-factor authentication, or with a magic link: a secure emailed link with no password needed. Google and Microsoft sign-in are supported, and managed single sign-on is available on request.
Two-factor authentication
BoardSite supports two-factor authentication using an app-based or text-message code, and administrators can require it for members. Members can use a separate phone number for login codes without revealing it in the member directory.
Role-based, need-to-know access
Members, committee members, and outside participants see only the materials they are entitled to, controlled by role and committee. Everything in BoardSite is access controlled.
Audit logging
Every action in BoardSite is logged, including logins, votes, changed votes, RSVPs, and content updates. Administrators can review the full activity log and support governance reviews with actual data.
Vulnerability scanning
BoardSite uses continuous automated vulnerability scanning through Intruder, with weekly scheduled scans and reports.
Your data is yours
Your organization owns its board data. A complete export is available on request in standard formats; the BoardSite team currently generates it rather than offering an automated self-service export.
Data residency
BoardSite is hosted in the United States today. Canadian and EU data residency are in development, with board records stored in your region. If your organization has a residency requirement, let us know and we’ll add you to the list.
Join the residency listEncryption
All data is encrypted in transit using TLS 1.2 or 1.3. Our managed database is encrypted at rest at the volume level, and documents are stored in encrypted object storage accessible only through BoardSite’s application layer, never directly. File names are encoded, and stored objects cannot be shared or accessed by URL.
Backups
Documents are backed up daily to encrypted off-site storage, held separately from production systems. Our managed database is backed up automatically with point-in-time recovery. Backup access is restricted separately from both production and development access.
Infrastructure & subprocessors
BoardSite runs on DigitalOcean and Amazon Web Services, with Cloudflare providing edge security and web application firewall protection. We use Stripe for payments, Mailjet for transactional email, and Intercom for support chat. A current subprocessor list is available on request.
AI data handling
BoardSite’s AI features run on Cavendo Engine, an open-source orchestration layer hosted on BoardSite infrastructure. Your board content is not sent to any third-party platform other than the model providers themselves, Anthropic and OpenAI, whose commercial terms state that customer content is never used to train their models. Content sent to those providers is retained briefly for abuse monitoring and then deleted. BoardSite retains AI content for quality review, with access limited to authorized staff and all access logged.
Availability
Real-time system status and incident history are published at status.boardsite.com.
Incident response
If a security incident affects your data, we will notify you within 72 hours of becoming aware of it, and will keep you updated through resolution.
Certifications
BoardSite is not currently SOC 2 certified. We can share our security practices, control documentation, and infrastructure details with prospective customers under NDA, and we will complete your organization’s own security questionnaire as part of your evaluation. If certification is a requirement for your organization, tell us early and we’ll be straight with you about where we stand.
Policies: Review our Privacy Policy and Terms of Service. Contact us about your organization’s data-protection or residency requirements so we can answer against the requirements that actually apply.
Security contact
Reporting a security issue
Report a security issue through our contact form. We respond to reports within one business day and will keep you updated through resolution.