Security and Privacy

Boardwise is designed to protect sensitive board materials and ensure only authorized people can access your organization's information.

How Your Data Is Protected

Encryption in Transit

All connections to Boardwise use HTTPS with TLS encryption. This ensures that data traveling between your device and our servers cannot be intercepted or read by third parties.

Secure Token Generation

Boardwise uses cryptographically secure random tokens for sensitive operations including:

• Session authentication
• Magic sign-in links
• Meeting RSVP links
• Calendar feed URLs
• Invitation tokens

These tokens are generated using secure methods that make them impossible to guess or predict.

Access Controls

Every request to Boardwise is verified against multiple layers of access control before any data is returned. See the Access Control section below for details on how permissions work.

Multi-Tenancy and Data Isolation

Each organization in Boardwise operates in complete isolation from others.

How Isolation Works

• Every piece of data (documents, meetings, people) is associated with a specific organization
• Database queries automatically filter to your organization's data only
• Cross-organization data access is architecturally impossible through normal application use
• Even if you belong to multiple organizations, each organization's data remains completely separate

What This Means for You

• Other organizations cannot see your documents, meetings, or member information
• Your data is never mixed with or accessible to other Boardwise customers
• Administrative actions in one organization have no effect on other organizations

Passkeys and WebAuthn

Boardwise supports passkeys, a modern authentication method that is more secure than traditional passwords.

Benefits of Passkeys

• Phishing resistant: Passkeys only work on the legitimate Boardwise site and cannot be tricked by fake login pages
• No passwords to remember or steal: Authentication uses cryptographic keys stored securely on your device
• Biometric protection: Access requires your fingerprint, face, or device PIN
• No shared secrets: Unlike passwords, passkeys never leave your device

Supported Methods

Passkeys work with:

• Touch ID and Face ID on Apple devices
• Windows Hello
• Hardware security keys (YubiKey and similar devices)
• Android biometric authentication

To add a passkey, go to Profile > Security > Add Passkey.

Session Management

Boardwise tracks your active sessions so you can monitor and control where you are signed in.

Session Tracking

Each time you sign in, Boardwise records:

• The device and browser you used
• Your IP address
• When you last accessed Boardwise from that session

This information helps you identify any unauthorized access to your account.

Managing Sessions

You can view and manage your sessions from Profile > Security:

• See all devices currently signed into your account
• Sign out from individual devices you no longer use
• Sign out from all devices at once if you suspect unauthorized access

Automatic Session Updates

Session activity is periodically refreshed to track when each device was last used. This helps you identify stale sessions that may have been forgotten on shared or old devices.

Data Retention

Organizations can configure how long documents and meeting materials are retained before automatic deletion.

How Retention Works

• Organization default: Each organization sets a default retention period for all content
• Override at any level: Meetings, folders, and individual documents can have custom retention periods
• Inheritance: Documents inherit retention settings from their parent (meeting or folder) unless specifically overridden
• Indefinite retention: Content can be marked for indefinite retention when required

Retention Transparency

When viewing a document or meeting, you can see:

• When the content will be permanently deleted (if a retention period applies)
• Where the retention setting comes from (organization, folder, meeting, or document level)
• Whether the content is marked for indefinite retention

This ensures you always know the lifecycle of your board materials.

Audit Trails and Activity Logging

Boardwise maintains detailed records of important actions for security and compliance purposes.

What Is Logged

Security events:
- User logins and logouts
- Failed authentication attempts (including WebAuthn failures)
- Password changes and reset requests, from before Boardwise stopped using passwords
- Session terminations (including forced logouts)
- New user account creation

Content events:
- Document creation, updates, and deletion
- Meeting creation, updates, and cancellation
- Committee creation, updates, and deletion

Administrative events:
- Organization setting changes
- People added, updated, or removed
- Role and permission changes

Event Details

Each logged event includes:

• Who performed the action
• When it occurred
• Which organization it affected
• Relevant details about the change

Organization administrators can review these logs to monitor activity and investigate security concerns.

Access Control Overview

Boardwise uses a layered permission system to control who can see and do what.

Three Layers of Access

1. Organization role determines your baseline access across the entire organization (Admin, Member, or Guest)

2. Group role grants additional permissions within specific boards or committees (Chair, Secretary, Member, Observer, Staff, and others)

3. Resource grants provide access to specific meetings and their documents through invitations

How Layers Combine

Your effective access is the combination of all applicable layers:

• A Guest at the organization level can still have full access to a committee where they are a member
• Meeting invitations grant document access even to users who would not otherwise have permission
• Admins have full access regardless of group memberships

Meeting-Only Access

External participants invited to a single meeting receive temporary access that:

• Includes only that specific meeting and its documents
• Does not grant access to other organization content
• Automatically expires 30 days after the meeting ends

For more details on roles and permissions, see Understanding Organization Roles.

Best Practices

For Individuals

• Add a passkey to your account for stronger security
• Review your active sessions periodically and sign out from devices you no longer use
• Report any suspicious activity to your organization administrator

For Administrators

• Assign the most restrictive role that allows each person to do their job
• Use Guest roles for external participants who only need limited access
• Review the activity log regularly for unusual patterns
• Consider enabling passkeys organization-wide for enhanced security