Security

Data isolation

Each organisation's workspace is isolated from every other customer. Access to board data is enforced in the application and in the database, so one workspace cannot read or change another.

Guest Mode never creates a cloud workspace. That board stays in the browser on the device. Nothing from Guest Mode is sent to our servers unless the user later chooses to import it into an account.

Authentication and access

Workspace members sign in with email and a password, handled by an established authentication provider. Passwords are stored hashed by that provider; we do not store them in the clear.

Inside a workspace, access is role-based:

• Owner — administers the workspace, billing, and membership
• Editor — creates and changes board content
• Viewer — reads the board

People join a workspace only when an owner invites them. A signed-in session is required for cloud workspaces. We apply standard browser security headers on the site.

We do not currently offer single sign-on or multi-factor authentication for customer accounts. If your organisation requires either, we may introduce it.

Encryption

All traffic to the product uses HTTPS/TLS. Data at rest is encrypted by our hosting and database providers. We do not add a second application-level encryption layer on individual board fields. Card numbers never reach our systems; Stripe handles payments.

Backups and recovery

The production database is backed up automatically on a regular schedule. We have a restore process for the service. After a subscription ends, workspace data is retained for a limited period and can be deleted earlier by the owner, as described in the Terms and DPA.

Infrastructure

We do not host the product on our own servers.

• Application hosting: Vercel
• Database, authentication, and related storage: Supabase, primary region EU Central (Frankfurt)
• Payments: Stripe
• Transactional email: Resend

Production and development use separate environments. Sub-processors and transfers are listed in the Privacy Policy and DPA.

Access to production

Access to production systems and customer workspace data is limited to people who need it for operations and support. That access is individual, not shared, and protected with multi-factor authentication. We do not use customer board content for marketing or training.

How we build and operate

A security standard such as ISO 27001 is, among other things, a demand that work is done in a repeatable way — not as ad hoc chaos. We are not ISO 27001 or SOC 2 certified. We do run NSF Board in that spirit: a small, explicit change process, production kept separate from development, and a software development life cycle shaped by many years of shipping business software and by established industry practice. We keep the application, dependencies, and platform current, and we review access and security settings as the product changes.

Incidents

If we become aware of a security incident or personal data breach that affects your workspace, we investigate and notify you without undue delay, with enough information for you to meet your own obligations (see the DPA). To report a suspected issue: info@northstarframework.com.

What this page is not

This is a public summary of how we run NSF Board. It does not replace the DPA, list every control, or describe how the system is implemented internally. We update it when the facts change.