Security and confidentiality

Your board's papers are the most sensitive documents you hold. We treat them that way.

Boardside is built so that only the right people, on the right board, ever see them. Here is exactly how we keep your information secure.

Where your data lives

Your information is hosted in Australia (AWS Sydney), through our infrastructure provider Supabase. Your board papers, registers, minutes, and profile data are stored in your account so your board can access them. We never sell your information, and we never share it for advertising or marketing by third parties.

Every board is isolated

Each board's data is separated at the database level by row-level security, so a member of one board cannot reach another board's papers, registers, or minutes. Within a board, access is scoped to your role: a director sees what a director should see, and management functions stay with management. Where a director has a declared conflict of interest, the affected paper is withheld from them automatically.

Encryption and access

All data is encrypted in transit (TLS) and at rest. Passwords are stored only as salted bcrypt hashes, never in a readable form. Sessions use short-lived, HTTP-only, secure-flagged tokens, so a session cannot be read or reused from the browser.

AI, handled with restraint

Boardside uses AI to generate intelligence for your board, but we send our AI provider only the minimum non-sensitive context a task needs, such as sector, role type, and general signal data. Your uploaded board papers, registers, and personal profiles are not sent to the AI provider unless a feature explicitly requires it and you initiate it. Under our provider's API terms, your inputs are never used to train their models.

Our sub-processors

We rely on a small number of trusted infrastructure providers: Supabase (database and authentication, hosted in Australia), Vercel (application hosting), and Anthropic (AI processing). Each receives only the data required to perform its function. Our Privacy Policy lists them in full and explains how each is used.

Built for New Zealand boards

Boardside is a New Zealand company, built for New Zealand boards. We are built to comply with the New Zealand Privacy Act 2020 and its thirteen Information Privacy Principles, and we apply the controls described on this page to every board on the platform.

If you believe you have found a security issue, or have any question about how we protect your board's information, please write to support@boardside.io.