These are your corporate records.
They should outlast a laptop, a phone, and any single year. Here is how BoardBasis holds them, in plain terms.
Only you can see your records
Every row in the database is tied to your account, and that separation is enforced by the database itself rather than by application code that could forget to check. A request carrying the wrong account simply returns nothing.
Your advisors have no accounts
They never sign in, so there is no second set of credentials to your company's records. Invitations and circulated minutes reach them by email and calendar invite; a reply link works only for that one invitation.
Finalized minutes are never edited
When you finalize a set of minutes, that version is kept as it was. Asking for changes produces a new version alongside it rather than overwriting what came before. A record you can quietly rewrite afterwards is not worth much as a record.
The trail is append-only
Invitations sent, replies received, minutes finalized — these are written once, with the time they happened, and not amended later.
Sign-in you control
Email and password, with optional two-factor authentication using an authenticator app. Turn it on and a password alone will not reach your records, even directly through the API. You get one-time recovery codes when you enrol, for the day you replace your phone.
Encrypted in transit and at rest
The site is served over HTTPS, and the database and file storage are encrypted at rest by our infrastructure providers, Supabase and Vercel.
Your records are yours
Print or download any set of finalized minutes whenever you like, including after you cancel. We do not sell data, and we do not share it with advertisers.
What the AI sees
Drafting minutes sends your answers, your company details and your recent minutes to Anthropic's Claude API to produce the draft. It is not used to train models. If that is not acceptable for a particular matter, keep it out of the meeting record.
Being straight about where we are
BoardBasis is new and small. We have no SOC 2 report and no penetration-test certificate, and we would rather say so than imply otherwise — you are trusting a young product, and you should know that when you decide.
What we can tell you is how it is built, which is what this page is for. If you have a question this page doesn't answer, ask us and we'll answer it honestly.
Keep printing and signing your minutes. The physical minute book is the thing that has always mattered, and no software should make you dependent on it staying online.
This tool provides organizational templates and general governance guidance only. It does not provide legal, tax, or financial advice.