Where your data lives
The database, authentication and file storage run in the European Union, in Ireland. Platform compute runs in Dublin, and the AI models used during onboarding run in EU regions. Cap tables, registers and documents therefore stay in the EU at rest.
A few things are held or processed outside the EU, such as the delivery logs of emails the platform sends. They are listed, with the safeguards that apply, under “Where your data lives” in our privacy policy.
Access control
Security is enforced in the database, not bolted on in the app.
- Row-level security on every table: each query is checked against the user’s company membership and permissions inside Postgres, so application code cannot leak data across companies.
- Cross-company access tests run before every release.
- Least privilege across roles, keys and providers.
- Each investor sees their own position, and data room access is set file by file.
Signing in
- No passwords to steal or reuse: sign-in is by a one-time code sent to your email, or with Google.
- An authenticator app can be added by anyone, as a second factor.
- Sensitive actions ask you to confirm it is you before they go through.
Documents and data rooms
- Private storage for every document. Links are short-lived and are created only after a permission check.
- Data rooms are view-only and watermarked.
- Engagement tracking records who opened a room or a document and when, with the IP address stored only as a hash.
- Company logos and team photos are public by design.
Encryption
Data is encrypted in transit (TLS) and at rest, and the off-site backup copy is encrypted.
Audit log
Sensitive actions are written to an immutable audit log: who did what, to which record, and when. The company’s admins can read it, and it is kept for 24 months for security investigations and audits.
Backups and deletion
- Daily database backups, kept for seven days, and an encrypted off-site copy kept for 90 days. Backups exist to recover from a failure and are never used to restore data that was deleted.
- When a workspace is closed, its data is deleted 30 days later, and backup copies expire on the schedule above.
Sub-processors
Boardroom uses a short list of sub-processors for hosting, storage, AI document processing, email and payments, each engaged on Article 28 terms, with 30 days’ notice before one is added or replaced. The full list, with what each does and where, is on our GDPR page.
Reporting a vulnerability
If you find a security vulnerability in helloboardroom.com or portal.helloboardroom.com, please report it to contact@helloboardroom.com. We welcome reports made in good faith. Please do not include customer data in a report.
Our contact details are also published in security.txt.