The short version, for a fast review. Customer board data is hosted in Canada, encrypted at rest and in transit, and protected by passkey authentication. Full control detail, FAQs, and document requests are on the security page.
Security questions: security@boardwise.co · Last reviewed June 2026
| Hosting & residency | AWS, Canada — Montreal (ca-central-1). Customer data — database and documents — stored in Canada. |
|---|---|
| Encryption | AES-256 at rest · TLS 1.2 or higher in transit |
| Authentication | Passkeys (WebAuthn) for users — no passwords · MFA enforced for staff |
| Production access | Restricted to two founders · individual accounts · MFA · logged |
| Infrastructure certs | AWS ISO/IEC 27001 + SOC 2 (Canada region), attributed to AWS |
| Boardwise SOC 2 | Controls aligned with the SOC 2 Trust Services Criteria · independent examination not yet started |
| Backups & recovery | Daily / weekly / monthly + point-in-time recovery · restores tested quarterly |
| Availability | 99.95% objective · live status at status.boardwise.co |
| Network | Cloudflare WAF + DDoS protection · database on private networking, not public |
| Monitoring | CloudTrail, GuardDuty, Security Hub, Inspector · centralized logging & alerting |
| Security testing | Automated scanning (Beagle Security) · independent penetration test on roadmap |
| Amazon Web Services | Hosting & document storage | Canada |
|---|---|---|
| Crunchy Data | Managed PostgreSQL database | Canada |
| Cloudflare | DNS, CDN, WAF | Global edge |
| Postmark | Transactional email | United States |
| Google Workspace | Email & internal identity | United States |
| AppSignal | Error tracking | European Union |
| BetterStack | Uptime & observability | European Union |
| Stripe | Payment processing (billing) | United States |
Board content (documents, minutes, database) is hosted with AWS and Crunchy Data in Canada. Other sub-processors handle operational metadata only.
A security overview, sub-processor/DPA details, and policy documents are available to customers and prospects under confidentiality. Requests are logged; we review each one individually and follow up to share the materials securely.
Thanks — your request has been logged and sent to our security team. We'll review it and follow up to share the materials securely.
Looking for full control detail and the security FAQ? See the security page.