Your boardroom is private. So is your workspace.
MyDirector-OS holds some of the most sensitive material a professional ever handles - board packs, minutes, fee records, conflicts. Here is exactly how we protect it.
How your data is protected
Seven controls that sit underneath every page.
Encryption in transit & at rest
Every connection uses TLS 1.3. All data - board packs, resolutions, profile documents, mailbox attachments - is encrypted at rest using AES-256 on managed cloud infrastructure.
Row-level access controls
Every database table enforces row-level security. A signed-in user can only read or write their own records - never another director's. Enforcement lives in the database itself, not just the app.
Your data is never used to train AI
BoardLens AI processes your documents on request and discards them. Your content is not used to train, fine-tune or improve any model - ours or the underlying provider's.
Private storage buckets
Board packs, resolutions, signatures, KYC documents, expense receipts and mailbox attachments live in private buckets. There are no public URLs - access requires a signed, time-limited link issued only to you.
Authentication you control
Email + password with leaked-password protection (HIBP), Google and Apple sign-in. Sessions are short-lived with automatic refresh. You can sign out of all devices and delete your account at any time. Two-factor authentication (TOTP) is available to all directors. Enable it from Settings → Account to add a second verification step on every sign-in, protecting your workspace even if your password is compromised.
Enterprise-grade hosting
Hosted on Supabase (Postgres) and Cloudflare's global edge. Daily encrypted backups, point-in-time recovery, and infrastructure that has been independently audited (SOC 2, ISO 27001 at the provider level).
SHA-256 document signing
Every document signed carries cryptographic fingerprints for both the original and signed versions, admissible under the UK Electronic Communications Act 2000 and eIDAS Regulation Article 25.
How we handle your data
Policies, written in plain English.
Private by default
MyDirector-OS is a single-tenant workspace per director. No team members, no shared org accounts, no co-pilots reading your packs - only you, by design.
Audit log
Sensitive actions - document downloads, AI reviews, profile changes, resolutions - are recorded in your own audit log, viewable from inside the app.
GDPR rights, built in
Export every byte of your data as a single JSON bundle from Settings. Delete your account and we erase your data within 30 days, with limited retention only where law requires it.
Cancellation and data deletion
When you cancel, you keep export access during a short grace period. After that, your portfolio, documents and AI reviews are permanently purged from active systems.
Incident response
We monitor for unauthorised access and unusual activity. In the event of a personal-data breach affecting you, we will notify you and the relevant supervisory authority within 72 hours, as required by UK / EU GDPR.
Where your data lives
Primary data is processed in the UK / EU. Where a sub-processor (e.g. an AI provider) operates outside the UK / EEA, transfers are protected by Standard Contractual Clauses or an equivalent adequacy mechanism.
Data portability
Your data belongs to you. Always.
MyDirector-OS is built on a simple principle: your governance records are yours, not ours.
Every appointment, board pack, compliance record, invoice and document you store in MyDirector-OS is exportable in full at any time - from Settings → Data - in a standard format you can read, store and use independently. No lock-in, no dependency, no permission required.
The infrastructure beneath your workspace holds automated daily backups with point-in-time recovery. Your data is never held in a single location and is never at risk from a single point of failure.
You chose to trust MyDirector-OS with your governance records. We take that seriously - which is why we have designed the platform so that trust is never a requirement.
Accuracy
Evaluated for accuracy.
100%
Answer consistency on every answerable question
Zero
Fabrications across every run
100%
Correct abstentions where the information does not exist
It never invents an answer. When it does not know, it says so. When it does know, it is right.
Sub-processors
Who else touches your data - and why.
We use a small, deliberate set of vendors. Each is bound by a data processing agreement and processes data only on our instructions.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, file storage | EU |
| Cloudflare | Application hosting & edge delivery | Global edge |
| Lovable AI Gateway | BoardLens document review (zero-retention) | EU / US |
| Paddle | Payments & invoicing (Merchant of Record) | UK / EU |
| Mailgun | Transactional & inbound email | EU |
FAQ
The questions directors actually ask.
Can MyDirector-OS staff read my board packs?+
No. Documents are stored in private buckets behind row-level access controls scoped to your user ID. Staff access to production data is restricted to break-glass scenarios for support, requires your explicit consent, and is logged.
Does BoardLens send my pack to OpenAI or Google?+
BoardLens uses the Lovable AI Gateway, which routes to commercial LLM providers under zero-retention terms - providers do not store or train on your prompts. Documents are processed for the duration of your request only.
What happens if I lose my password?+
Use the password-reset link from the sign-in page. Reset emails are time-limited and single-use. Your data remains encrypted and inaccessible to anyone without a valid session.
How do I get a copy of everything you hold on me?+
From Settings → Data, request a data export. You receive a 24-hour signed download link to a JSON bundle covering every table your account touches.
Are you SOC 2 / ISO 27001 certified?+
MyDirector-OS is built entirely on infrastructure that holds SOC 2 Type II and ISO 27001 attestations - Supabase for database and storage, Cloudflare for application delivery, and our AI providers for document processing. These certifications cover the infrastructure on which every byte of your data is stored, processed and transmitted. As a focused single-product operation we do not carry our own independent certification at this stage - the infrastructure certifications that govern your data are published by Supabase and Cloudflare and are available on request.