Your security policy. No board exception.
Directors see the company's most sensitive information, often on devices you don't manage. Konsaro brings them under your identity, access and audit controls, in a place they'd rather use than email.
The board exception
Your most sensitive data sits with your least-managed users.
Directors see results before the market, deals before they close and leadership changes before they're announced. Yet many are external, on personal devices and outside your directory, so board papers end up wherever is convenient.
- Board books in private inboxesBoard PDFs get forwarded to personal addresses and saved to tablets, beyond every control you run.
- Accounts outside your directoryExternal directors have no company identity. Their access is set up by hand, and rarely removed when they leave.
- No answer to “who saw it?”When a document leaks, email can't tell you who opened it, when, or where it went next.
With Konsaro
Bring the board inside your security model.
The controls you already run everywhere else, identity, least privilege and logging, applied to board papers, meetings and decisions.
01 · Identity
Directors sign in the way your company does.
Members sign in with your organisation's Microsoft account; external directors use two-factor authentication. No separate board passwords for anyone to manage.
- Single sign-onSign-in with your organisation's Microsoft account (Microsoft Entra ID).
- Second factor for email linksAdministrators can require a second factor for sign-in by email link.
- MFA and idle sessionsUsers set up two-factor authentication with an authenticator app or SMS code. Administrators can end inactive sessions automatically, and failed sign-ins are rate-limited.
02 · Least privilege
Each paper reaches only the people who need it.
Restrict a document or agenda item to selected members. Room roles set the baseline, and invited guests see only what is meant for them.
- Per-document accessLimit a single document or agenda item to named people, beyond room membership.
- Roles plus fine-grained rightsRoom roles for organisers, secretaries and attendees, with finer access on single documents.
- Guests per itemAn advisor joins for their item only and sees only its papers.
03 · No loose copies
Read anywhere, without forwardable attachments.
Papers are read inside Konsaro, behind sign-in, so nobody outside the access list holds a file to pass along. Every download is logged against a named person.
- No attachmentsBoard books are shared as access in Konsaro, not as email attachments.
- Downloads on recordEvery download and data extraction is logged per member and per document.
- Access ends with membershipRemove someone from the room, and their access to the papers ends.
04 · Audit trail
Openings, downloads and exports on the record.
Activity is recorded against a named person: the first opening of each paper, downloads and exports. When legal, audit or a regulator asks, you answer from the log, not from a round of emails.
- Activity trailFirst openings, downloads and data exports, per member and per paper.
- Controlled exportsData exports use short-lived download links and are kept only for a limited time.
- Exportable logExport the audit log for internal audit or your own archive.
Adoption
Controls only work if directors use them.
When the secure route is harder than email, board papers end up in email. Konsaro is built for directors first, so the controlled place is also the easiest place to read, prepare and decide.
- One current board book, nothing to forward or re-send
- Private notes right on the page
- The same board book on laptop, tablet and phone
Vendor review
Ready for your security review.
The answers your questionnaire will ask for, stated plainly. Security documentation is shared during a security review, and the DPA is published.
Stored in Switzerland
Board data is stored in Zurich. Application servers run in Germany.
Encrypted in transit and at rest
TLS in transit; encrypted at rest by our hosting provider.
Backups and continuity
Daily database backups, kept for 7 days, and a public status page.
Secure development
Threat modelling, peer review, dependency scans and an automated security assessment before every release. Critical or High findings block a release.
Incident response
A documented response process, from preparation to lessons learned.
AI that doesn't learn from you
AI runs in the EU, with zero data retention. Board material is never used to train AI models.
Bring your questionnaire.
Walk through it with our team, together with IT and your board office. You leave with the documentation your review needs.
- 1Send us your questionnaire or requirements
- 2See the setup and controls in a live walkthrough
- 3Receive the security documentation, the DPA and the subprocessor list
Roll it out together
Konsaro for the people you'll work with
Security signs off. The board office runs it day to day, and directors use it every meeting.
Corporate secretaries
Run the portal day to day, board books, permissions and the record.
Learn more — Corporate secretariesCompliance officers
Show that board processes ran as they should, with evidence.
Board directors
Read, prepare and decide from one current board book.
Learn more — Board directors
Customers
Boards that run on Konsaro
How board offices publish one current board book, run a focused meeting and keep every decision on record.
