Security & Trust
SectorBoard is built with security at every layer. Here's exactly how we protect your business data.
Last updated: August 2026 · Version 1.4
What we protect today
We only claim controls that are actually built and running. No aspirational checkboxes.
Data encrypted in transit
All connections to SectorBoard use TLS 1.2 or higher, enforced by Netlify's global CDN. Unencrypted HTTP is not accepted.
Credentials encrypted at rest
Every connector API key and OAuth token is encrypted with AES-256-GCM before being written to the database (lib/encryption.ts). The encryption key is stored separately from the ciphertext and is never logged.
Tenant isolation & database security
SectorBoard runs on Supabase (PostgreSQL). Every query is scoped to the requesting organisation in the application layer, and PostgreSQL Row Level Security is enabled on customer tables as a defence-in-depth backstop. The browser-side key can read no organisation's data directly, and service-role credentials are never exposed to the browser or client-side code.
Session security & automatic logout
Sessions use a signed, HTTP-only, Secure, SameSite cookie. Administrators can set an automatic inactivity logout (30 minutes by default) and an absolute session limit, and can instantly sign out every device. Optional two-factor authentication (TOTP) is available, and changing or resetting a password immediately invalidates every other session — on customer accounts and business coach accounts alike.
Brute-force protection
Sign-in, sign-up, password-reset and verification-code endpoints are rate-limited per client. Repeated failed sign-ins — for both business and coach accounts — are additionally throttled per account, so an attacker who rotates IP addresses is still blocked against the account they are targeting. This blunts credential-stuffing and password-guessing even when the attempts are spread across many addresses. These limits are enforced through a shared store, so they apply consistently across all of our servers rather than on any single one.
Request-forgery & SSRF protection
State-changing requests are protected against cross-site request forgery (SameSite cookies plus an origin check). Outbound connections that the server makes on your behalf — connector setup and webhooks — are validated against private and internal network ranges, so the platform cannot be steered into reaching internal services.
OAuth security
All OAuth flows use signed-JWT state cookies and PKCE S256 challenge/verifier pairs to prevent CSRF and authorisation-code interception attacks. State is validated server-side before any token exchange.
Activity & audit logging
Security-relevant events — sign-ins, failed sign-ins, changes to session-security settings, team and permission changes, and data-export requests — are recorded in a per-organisation Security & Activity log that admins can review, print and export.
Secrets scanning
Netlify secrets scanning runs on the repository, so accidental commits of credentials or API keys are flagged in CI/CD before they reach production.
Secure Slack alerts
Slack webhook URLs are stored encrypted in the database using the same AES-256-GCM scheme as connector credentials. They are never stored or transmitted in plain text.
Sub-processors
SectorBoard uses the following third-party services to deliver the platform. We share only the data each service needs to fulfil its function.
| Name | Role | Data region | Website |
|---|---|---|---|
| Supabase | Database & auth | EU (eu-west-1) | supabase.com |
| Netlify | Hosting & CI/CD | Global CDN | netlify.com |
| Google Workspace | Email delivery & mailboxes | Global | workspace.google.com |
| Stripe | Billing & payments | US | stripe.com |
| Anthropic | AI processing (AI tier only) | US | anthropic.com |
Data handling
We store the KPI values computed from your connected apps — not raw source records. We never store individual transactions, customer names, or unprocessed API payloads.
Workforce data: where you connect an accounting app that includes payroll, we read an employee reference number and employment dates for each of your employees, plus pay-run totals, so we can calculate headcount, revenue per employee, payroll cost per employee and staff turnover. We never read names, contact details, home addresses, dates of birth, National Insurance numbers or any individual's pay. Those individual records are held only in memory while a sync runs and are discarded once the figures are calculated — only the figures are stored. The full description is in our Privacy Policy.
We do not sell, share, or use your business data for any purpose other than providing SectorBoard to you.
AI features & the Atlas advisor: If your organisation uses SectorBoard's AI features or the Atlas advisor add-on, computed KPI values and organisational context (not raw connector records) are sent to Anthropic's API for analysis. Anthropic's API does not train on API inputs per their usage policy. The Atlas advisor, when enabled, analyses your KPI data automatically each night to prepare a morning briefing; every insight it produces is scoped to what each user is permitted to see(a director never sees a sector or another organisation they aren't cleared for), and it is advisory and human-in-the-loop — never a solely-automated decision. Atlas is an opt-in add-on that can be turned off.
Vulnerability reporting
Found a security issue? Email [email protected] with a description of the vulnerability and steps to reproduce. We aim to respond within 48 hours and will keep you informed as we investigate and resolve the issue. We appreciate responsible disclosure.
GDPR & data residency
SectorBoard is operated from the UK. Our primary database is hosted in the EU (Supabase, eu-west-1 region). We are GDPR-aware and maintain records of processing activities. A Data Processing Agreement (DPA) is available on request — email [email protected].
Certification roadmap
We're building toward formal third-party attestation. We'd rather show you exactly where we are than imply certifications we don't yet hold. Here's the plan and our honest current status. As groundwork, we operate the underlying controls today, map them to the SOC 2 Trust Services Criteria and ISO 27001 Annex A, and — for our AI advisor — have completed a GDPR Data Protection Impact Assessment and an independent code-level security review, with findings tracked and remediated.
Independent audit of our security, availability, and confidentiality controls over an observation period.
Controls run today and are mapped to the Trust Services Criteria (access control, encryption, logging, change management, incident response). The formal Type II observation window with an accredited auditor begins as we reach scale milestones.
Certified Information Security Management System (ISMS) covering policies, risk, and controls.
Targeted after SOC 2; many Annex A controls — access control, cryptography, logging & monitoring, secure development, and supplier/DPA management — are already in place and documented.
GDPR Data Protection Impact Assessment and an independent security review of our AI advisor.
A DPIA and an independent code-level security review have been completed for the Atlas advisor, with no critical or high-severity issues found in that scope. We also run ongoing security testing across the wider platform, with findings tracked and remediated. A commissioned third-party penetration test will follow ahead of enterprise scale.
Data Processing Agreement, records of processing, and EU data residency.
DPA available on request; primary data store hosted in the EU.
The certification process itself is run by accredited external auditors and is outside the scope of this page — this section reflects our roadmap and current posture, not a completed audit.