Security Is Foundational to Our Architecture
Board portals handle the most sensitive data in any organization: strategic plans, financial reports, legal matters, merger and acquisition discussions, executive compensation details, and confidential personnel decisions. A breach of board data can have severe legal, financial, and reputational consequences.
That is why security is not a feature we added to Preside, it is the foundation upon which every feature is built. From our infrastructure and encryption to our access controls and AI safeguards, every layer of the platform is designed to protect the confidentiality, integrity, and availability of your governance data. We subject our systems to rigorous independent audits, penetration tests, and compliance assessments so that you can trust Preside with your most critical information.
Data Encryption
Every piece of data that enters Preside is encrypted, whether it is being transmitted over the network, stored in our databases, or backed up for disaster recovery. We use industry-leading encryption standards to ensure that even if data were intercepted, it would remain unreadable.
AES-256 encryption at rest for all stored data, documents, and backups
TLS 1.3 encryption in transit for every connection to and from Preside
Board member messages and communications encrypted in transit and at rest
Encrypted backups with geographic redundancy across multiple regions
Database-level encryption ensuring all stored data is protected at the storage layer
Access Controls
Preside provides layered access controls that ensure every user sees only what they are authorized to see. From board-level roles to document-level permissions, administrators have fine-grained control over who can access, edit, and share sensitive governance materials.
Role-Based Access Control (RBAC)
Granular permissions mapped to governance roles (Chair, Vice Chair, Director, Secretary and Observer), each with precisely scoped access to documents, meetings, votes and administrative functions.
Granular Document-Level Permissions
Control who can view, edit, download or share each document. Restrict sensitive materials to specific committees or individuals.
Multi-Factor Authentication (MFA)
On our roadmapAuthenticator-app MFA for individual accounts. Organization-wide enforcement, hardware security keys and SMS verification are on our roadmap.
Single Sign-On (SSO) and SCIM
On our roadmapSAML 2.0 and OIDC single sign-on, with SCIM directory provisioning, are planned. Preside authenticates with email and password today.
Session Management
On our roadmapSessions expire automatically. Administrator-initiated session revocation, concurrent session limits and IP allowlisting are on our roadmap.
Audit & Monitoring
Complete visibility into every action taken within your board portal. Preside records every action server-side with the acting user, IP address and timestamp, giving compliance officers and administrators the transparency they need to evidence how a decision was reached.
Server-side audit logging that records the acting user, IP address, user agent and timestamp for every recorded action
Actions logged across documents, meetings, votes, resolutions, permission changes and administrative operations
An activity dashboard for administrators and compliance officers
Exportable audit reports formatted for regulators, auditors and compliance reviews
Append-only storage with cryptographic integrity verification and automated anomaly detection are on our roadmap
Infrastructure Security
Preside is built on hardened, managed cloud infrastructure from providers who are independently audited and continuously monitored. The architecture is designed for resilience, redundancy and rapid recovery, so your board data is available when you need it.
Hosted on enterprise-grade cloud infrastructure (Vercel and Neon) whose providers maintain their own SOC 2 Type II and ISO 27001 certified data centers
Encryption in transit and at rest
Geographic data redundancy with automatic replication across multiple availability zones
Automated failover and managed database backups
DDoS protection with automatic traffic analysis and mitigation
A formal Preside-level SOC 2 Type II audit, independent penetration testing and a published uptime SLA are on our roadmap
Compliance Frameworks
Preside aligns with the compliance frameworks that matter most to governance-focused organizations. We invest in certifications and assessments so you can demonstrate compliance to your stakeholders.
GDPR
Built to support the EU General Data Protection Regulation, including data subject access, export and deletion requests.
Learn moreSOC 2 Type II
Preside does not yet hold its own SOC 2 Type II attestation. Engaging an auditor is on our compliance roadmap.
ISO 27001
Information security management system certification. On our compliance roadmap.
HIPAA
Preside is not currently HIPAA compliant and does not offer Business Associate Agreements. Supporting covered entities is on our roadmap.
AI Security
Preside's AI features, including meeting summaries, governance insights, and the AI Board Advisor, are built with the same uncompromising security standards as the rest of the platform. We understand that AI introduces unique concerns for organizations handling sensitive data, and we have designed our AI architecture with strict safeguards.
Isolated Processing Environments
All AI features process board data in isolated, sandboxed environments that are logically and physically separated from other customers and workloads.
No Training on Your Data
Board data is NEVER used to train, fine-tune, or improve AI models. Your governance data remains yours alone and is not incorporated into any machine learning pipeline.
Encrypted and Logged AI Interactions
Every interaction with AI features is encrypted in transit and at rest. All AI queries and responses are recorded in your organization's audit log for full transparency.
No Third-Party Data Sharing
No board data is shared with third-party AI providers beyond the minimum required for processing your specific request. Data is deleted from processing environments immediately after use.
User-Controlled AI Access
Administrators control which data AI features can access. You decide whether AI can analyze meeting minutes, documents, or governance records, feature by feature.
Advisory Only, No Automated Decisions
AI outputs are strictly advisory. Preside's AI never makes governance decisions autonomously. Every recommendation, summary, or insight requires human review and action.
Data Privacy
Privacy is a fundamental right, and Preside is built to honor it. Our data privacy practices are grounded in the principles of the GDPR and extend to all users regardless of jurisdiction. We believe that strong privacy protections and effective board management go hand in hand.
Privacy by Design (Article 25 GDPR)
Data protection is embedded into the architecture and development lifecycle of every feature, not bolted on after the fact.
Data Minimization
We collect and process only the personal data that is strictly necessary for delivering board management services. No excessive data collection.
Purpose Limitation
Data is used only for the specific, stated purposes of board governance. We never repurpose governance data for advertising, profiling, or unrelated activities.
Storage Limitation
Clear retention policies with defined timelines. Automated deletion processes purge data that is no longer needed for its original purpose.
Right to Erasure
Organizations and individuals can request complete deletion of their data. We honor erasure requests in compliance with GDPR Article 17.
Data Portability
Export your data anytime in structured, machine-readable formats (CSV, JSON, PDF). Your data belongs to you, and you can take it with you.
Incident Response
Despite the strongest preventive measures, no organization is immune to security incidents. Preside maintains a documented, tested incident response program that ensures rapid identification, containment, and resolution of any security event, minimizing impact and maintaining trust.
24-hour incident response team with on-call security engineers available around the clock
72-hour breach notification to supervisory authorities and affected data controllers, in full compliance with GDPR Article 33
Documented incident response procedures covering identification, containment, eradication, recovery, and post-incident review
Regular tabletop exercises simulating breach scenarios to ensure team readiness and procedure effectiveness
Post-incident review and continuous improvement process, every incident results in documented lessons learned and security enhancements
Certifications Roadmap
Our commitment to security and compliance is ongoing. We continuously expand our certification portfolio to meet the evolving requirements of organizations across industries and geographies.
Current
- GDPR data subject rights
- Encryption in transit and at rest
- Role-based access and audit logging
In Progress
- SOC 2 Type II
- Independent penetration test
- ISO 27001
Planned
- HIPAA BAA
- SSO, SAML and SCIM
- FedRAMP (Government)
Contact us for our latest security documentation. Preside does not yet have its own SOC 2 report or penetration test summary to share. We can provide our architecture and data handling documentation under NDA, and we will say plainly which controls are in place today and which are planned.
Security FAQ
Where is my data stored?
Preside runs on managed cloud infrastructure (Vercel and Neon), currently in a single United States region. Those providers maintain their own certified data centers and replicate data across availability zones. Customer-selectable data residency is on our roadmap, so contact us if a specific region is a requirement for your organization.
Can I export my data?
Yes. Preside supports full data portability in compliance with GDPR Article 20. Organization administrators can export meeting records, documents, voting histories, member profiles, and audit logs in structured formats including CSV, JSON, and PDF. Bulk export tools are available for organizations transitioning to or from Preside, ensuring you always have complete access to your governance data.
How does Preside handle AI data?
Board data processed by AI features is handled in isolated environments and is never used to train or improve AI models. Data sent for AI processing is encrypted, logged in your audit trail, and deleted from processing environments immediately after generating the response. Administrators control which data AI features can access, and all AI outputs are advisory only, no automated governance decisions are made.
Is Preside HIPAA compliant?
No. Preside is not currently HIPAA compliant and we do not offer Business Associate Agreements. The platform provides encryption in transit and at rest, role-based access controls and audit logging, but we have not completed the controls and agreements a covered entity needs. Supporting HIPAA workloads is on our roadmap, and we would rather tell you that now than at contract stage.
How do I report a security vulnerability?
We take security vulnerabilities seriously and appreciate responsible disclosure. If you discover a potential security vulnerability in Preside, please report it immediately to security@presideos.com. Include a detailed description of the vulnerability, steps to reproduce it, and any supporting evidence. Our security team will acknowledge receipt within 24 hours and work with you to understand and remediate the issue. We do not pursue legal action against researchers who report vulnerabilities responsibly.
Your Board Data Deserves Enterprise-Grade Protection
Join organizations that trust Preside to safeguard their most sensitive governance data. Experience the security, compliance, and peace of mind that comes with a platform built for boards.
Questions about security? Contact security@presideos.com