Security and governance

Access rules are enforced on the server, on every request — not hidden in the interface.

Access control

• Row-level security in the database decides what each request may read or write, so access cannot be bypassed by calling the data directly.
• Board-level roles (chair, company secretary, executive director, non-executive director, adviser) are separated from system-level administration.
• People see only the organisations, boards and committees they are a member of.
• Two-factor authentication is available for every account, with backup codes.
• Password rules require at least ten characters with upper and lower case, a number and a special character.

Documents

• Board documents, packs and minutes are stored privately, not on public links.
• Files are opened through expiring secure links generated per request for people who already have access to that board or meeting.
• Board packs cannot be circulated before a chair or company secretary approves them, and unapproved drafts are not visible to ordinary members.
• Packs are versioned, and read receipts record who opened which version.

Audit trail

Every governance event — packs published, minutes approved, members added, permissions changed, documents uploaded, comments made — is written to a write-once record with the person, the record and the timestamp. The trail cannot be edited or deleted, and can be exported when a lender, investor, funder or auditor asks how a decision was reached.

Confidentiality between customers

Membership of the platform is confidential: there is no public or searchable directory of people or organisations, and nobody can look up whether a person has an account. Contact details are visible only to people who serve on the same board or attend the same meeting.

Hosting and data location

Data is processed in the UK and EU region of our hosting provider. The contracting party is SMART-BOARD.AI LTD, registered in England & Wales.

AI features

The AI board-readiness review is optional and runs per document. Papers stay in the customer's workspace; the text of a reviewed paper is sent to our AI provider solely to produce the score and recommendations, and it is not used to train any AI model. Nothing is shared with other customers, and the resulting score is visible only to people who can already see that paper. AI output is guidance for the board, not professional advice.

Email

Notifications and invitations are sent from the smart-board.ai domain with authenticated sending records, carry the recipient organisation's name, and state plainly why they were received so they can be distinguished from phishing.