Secure infrastructure
Microsoft Azure infrastructure operating to ISO 27001, CIS and GDPR standards.
Trust, security and sovereignty
Your board’s most sensitive work, with a European vendor.
BoardX is an Irish company with no US parent. Here is what that means for your data, and how we protect it.
European by design
A European company.
Not subject to US surveillance law.
BoardX is headquartered in Dublin and has no US parent company or US private equity control. US-controlled board portals can be ordered to hand over customer data under the US CLOUD Act and FISA Section 702, wherever that data is stored. BoardX is not a US company, so those orders do not apply to us.
For boards handling strategy, member data and regulatory matters, who controls the vendor matters as much as where the servers sit.
| Question to ask your vendor | US-controlled vendor | BoardX |
|---|---|---|
| Where is the company controlled from? | United States | Ireland (EU) |
| Can it be compelled under the CLOUD Act? | Yes, even for data held in the EU | No. Not a US company |
| Is it subject to FISA Section 702? | Yes, as a US provider | No. Not a US company |
| Which law governs your contract? | Often US law | Irish law |
Our infrastructure partner and every sub-processor are listed in the BoardX sovereignty brief, available on request. This page is general information, not legal advice.
Security
Security built into the platform, not added on.
A database for every customer
Your records are held separately from every other customer’s.
Two-factor authentication
Standard for every user. Single sign-on is coming soon.
Role-based access
Permissions and pack redactions carry through to every AI answer.
Recordings under your control
Meeting audio and video stream into your own database. Pause for off-the-record moments and permanently delete when the minutes are approved.
No training on your data
Your board’s records are not used to train AI models.
Questions boards ask us
CLOUD Act, FISA and where your data lives.
What is the US CLOUD Act?
A 2018 US law that lets US authorities order US-controlled technology companies to hand over data they hold or control, even when that data is stored outside the United States, including in the EU.
What is FISA Section 702?
A US surveillance law that allows US intelligence agencies to require US electronic communication service providers to assist in collecting the communications of non-US persons outside the United States.
Why doesn’t this apply to BoardX?
Both laws are aimed at companies under US jurisdiction. BoardX is incorporated and headquartered in Ireland, with no US parent company, and is not a US provider for the purposes of these laws.
Where is my data hosted?
BoardX runs on Microsoft Azure data centres in the EU, with a separate database for each customer. Our sovereignty brief sets out our infrastructure partner, every sub-processor and how your data is protected at each layer.
Does BoardX use my data to train AI?
No. Your board’s records are used only to answer your organisation’s questions.
Is this legal advice?
No. This page is general information. We recommend your counsel review our sovereignty brief and data processing agreement.
See BoardX in action
Request the BoardX
sovereignty brief.
Our infrastructure, sub-processors and data protection controls, ready for your DPO, counsel or risk committee.