Boardrooms run on candor. Candor runs on security.

Members share real financials, real strategy, and real disagreements inside BoardRoom. Protecting that is the product. Here's how we approach it.

Access control, enforced at the database

Every record is protected by row-level security policies enforced in the database itself — not just in application code. Boardroom posts, documents, messages, and meeting details are readable only by that board's members. Public advisor profiles expose an explicit allowlist of fields; private data (email, billing status) is never present in any public payload.

Encryption

All traffic is encrypted in transit (TLS 1.2+, HSTS enforced). Data is encrypted at rest by our infrastructure providers (Supabase/AWS). Board documents live in private storage accessible only through short-lived signed URLs issued to authorized members.

Payments

Card data never touches our servers. Payments are processed entirely by Stripe, a certified PCI Level 1 service provider. We store only the subscription state needed to operate your account.

Infrastructure & operations

• Least-privilege service credentials; admin operations are server-side only and audit-logged.
• Separate staging and production environments; database changes ship as reviewed migrations.
• Point-in-time database recovery and scheduled backups.
• Anti-abuse controls (bot protection and rate limiting) on public forms.

Your controls

• Self-serve cancellation and data requests — email us to export or delete your data (GDPR/CCPA honored).
• Email preference center; one-click unsubscribe on every marketing email.
• Leave any board at any time; your access ends immediately.

Found a vulnerability? Please report it to security@boardroom.example — we read every report and respond fast.