Your privacy records, kept in Paris.
A privacy tool should hold itself to the standard it helps you meet. Here is where your data lives, how it is protected, what goes to AI and who processes it for us.
Where your data lives
Database, sign-in and files
Your records, documents and uploaded agreements are stored by Supabase in its Paris region (AWS eu-west-3).
The app itself
The pages and API that read and write your workspace run on Vercel functions in Paris (cdg1), next to the database.
Your cookie banner
The banner script is delivered from a global network so it loads fast for every visitor. The consent choices it saves go to the Paris API.
How it is protected
Encryption
Data is encrypted at rest with AES-256 and in transit with TLS, by our hosting providers.
Daily backups
The production database is backed up every day.
Access rules in the database
Row-level security is on for every table: a workspace’s data is only returned to its own members, whatever the request.
Two-step verification
Every member can turn it on. On Business, an owner can require it for the whole workspace.
Audit log
Who changed what and when, kept 3 years on Business, with roles from viewer to owner.
Bot protection
Sign-in is protected by Cloudflare Turnstile, which stops automated attempts without a puzzle.
What goes to AI
AI only drafts. Nothing it writes is saved until someone on your team reads and approves it.
- Security questionnaire autofill (Business)
Claude, by Anthropic, receives the questions and the records your AI assistant connector would show. It never sees who sent a privacy request or the details of an incident.
- Privacy center translation (Business)
Only the passages you choose are sent, with names, email and web addresses replaced by markers first.
- Not used for training
Anthropic does not train its models on data sent through its API.
- Your own assistant
The MCP connector lets the assistant you choose read your records. Every change it prepares waits for your confirmation. AI assistants and your data
Who processes data for us
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication and file storage | European Union (data stored in the EU; Supabase Inc. is a US company) | Standard contractual clauses |
| Vercel | Application hosting and delivery | United States and global edge network | EU-US Data Privacy Framework |
| Resend | Transactional emails (notifications, privacy request replies) | United States | EU-US Data Privacy Framework |
| Cloudflare | Website scans in a real browser, bot protection on forms | United States and global network | EU-US Data Privacy Framework |
| Google Workspace | Support mailbox (messages you send us) | European Union and United States | EU-US Data Privacy Framework |
| Anthropic | AI suggestions in the product (security questionnaire answers, privacy center translations), and AI assistance used by our team for development and support. Not used to train models | United States | Standard contractual clauses |
This is the list in our data processing terms, which say how we tell you before adding a provider. Payments go through Lemon Squeezy: we never see your card number.
Certifications, plainly
Privacyboard itself holds no ISO 27001 or SOC 2 certification, and we will not suggest otherwise.
The providers that host your data do: Supabase (SOC 2 Type 2, ISO 27001) and Vercel (SOC 2 Type 2, ISO 27001:2022). Their reports are available from them.
Found a vulnerability? Write to hello@privacyboard.io before sharing it. Details in our security.txt.
Be ready before they ask.
Start with your website address. In about 5 minutes your first documents are ready, with no password to create.
Start free