Trust
Your record cannot be rewritten. Including by us.
Your data stays in your country. Money cannot move without a decision behind it.
The architecture
Every table carries the corporation it belongs to, and the database refuses a read or a write that crosses that line.
Sensitive documents and sensitive fields are encrypted with a key held per region.
The audit chain
Every consequential action writes an append-only, hash-chained event. Altering one breaks the chain, and the break shows.
Every export ships with the verifier, so your record does not depend on us continuing to exist.
Who can do what
Capabilities attach to roles, not to people.
Treasury actions need a second factor at the moment of the action, not just at sign in.
Sessions and devices are listed and revocable.
Money rules in the database
No payment leaves without a decision behind it.
Approval and release are separate acts by separate people.
An invoice is matched to the purchase order and to the record that the work happened.
One fund's money cannot be spent on another fund's purpose without a recorded transfer.
History is append-only. A correction is a new entry that references the old one.
Backups and recovery
Managed Postgres with continuous backups and point-in-time recovery, in the Canadian region.
Documents are versioned and soft deleted rather than removed, so a mistaken deletion is recoverable.
We are not publishing recovery point and recovery time figures yet. That is deliberate, not an omission.
Our compliance programme
We run a SOC 2 readiness programme. No audit has taken place and no report exists.
No third party penetration test has been carried out yet.
Dependencies are scanned on every build, and payment, banking and cryptography changes need a second reviewer.
Reporting a vulnerability
Write to security@boardbutler.com.
There is no bug bounty today, and we say so rather than implying one.
Questions we get asked
Where does our data live?
Canadian corporations are in a Canadian database region and a Montreal storage bucket. The subprocessors page names every vendor and its region.
Can Board Butler staff read our records?
Only through a session that needs a reason, expires, and is logged in the same chain your board reads. Nobody here has a quiet way in.
Have you been through a SOC 2 audit?
No. Controls implemented and evidence collected. When an audit happens we will publish the report and name the auditor.
What happens to our data if we leave?
You export everything, in open formats, with the audit chain and its verifier, without asking us.
Notes
- Tenant isolation. It is not a filter the application remembers to apply. It is a rule the database enforces on every query, including ours.
- Encryption. The per-region key sits on top of the encryption the database and the object store already apply, so a copy of the storage without the key is ciphertext. Traffic is encrypted in transit everywhere, with strict transport security on every response.
- Anchoring. The chain is anchored to an external timestamp authority, which is what turns it from our word about when something happened into evidence a third party can check.
- The second factor. Treasurers, presidents, bookkeepers and Board Butler staff must enrol one, and the rest of the board is encouraged to. Single sign on is available for a board that has an identity provider, and enabling it does not switch the second factor rule off.
- Why the database and not a policy. A disbursement with no authority attached cannot be written at all, so the control cannot be skipped by using a different screen. Segregation of duties is checked against the capabilities a person actually holds, not against a chart.
- The recovery figures. The figures written into our specification were derived against a database vendor we no longer use. Republishing them against a different platform would state a commitment we have not measured. They go up once a restore drill has been run against the platform the data sits on, and this page will name that date.
- Readiness. The policy set is written, the controls are implemented, and the evidence is collected automatically from our own build and operations. When an audit happens we will publish the report and name the auditor. When a penetration test happens we will name the firm and the date.
- Disclosure scope. Good faith research on your own account or on a test corporation is welcome and we will not pursue you for it. Denial of service testing and social engineering of our customers are out of scope. We acknowledge every report, say where it stands, and credit researchers who want to be credited.
See it on your own corporation
A demo runs on a seeded corporation with a real audit chain. Break a rule and watch the product refuse.