Trust Center

How Konsaro protects your board's data: where it is stored, who can reach it, and what happens to it. Written for IT, data protection and procurement teams.

Last updated: 28 October 2026

Zurich
Board data stored in Switzerland
Encrypted
TLS in transit, encrypted at rest by our hosting provider
No training
Your data never trains AI models
14 days
To export your data when a contract ends

Where your data lives

Board data: The database, uploaded documents and sign-in data are stored in Zurich, Switzerland.
Application: The web application runs on servers in Germany.
Backups: The database is backed up daily, and database backups are kept for 7 days. A daily backup copy of uploaded files is kept on the application servers in Germany.
Email and SMS: System emails are sent through a provider based in the United States, from Ireland. SMS sign-in codes are sent from the United States. They receive names, email addresses, phone numbers and message content, including meeting and agenda titles, but no documents or attachments.

AI

What it does: Rephrasing and translating text, translating documents for attendees, and suggesting tasks. The board office reviews every result before it is shared.
Where AI runs: AI requests are processed in the EU only, with zero data retention. Nothing is kept once a request is answered.
No training: Your board material is never used to train AI models.
Your choice: AI features are switched on by default. Administrators can ask us at any time to switch them off for the whole organisation. While they are off, no content is sent for AI processing.

Sign-in and access

Company sign-in: Sign-in with your organisation's Microsoft account (Microsoft Entra ID).
Two-factor authentication: With an authenticator app or SMS codes, set up by each user. Administrators can require a second factor for sign-in by email link.
Sessions: Administrators can end inactive sessions automatically, for example after 30 minutes. Repeated failed sign-ins are rate-limited.
Roles and access lists: Role-based permissions, enforced in the database, plus access lists on single documents and agenda items.

Document protection

Security levels: Per document, room administrators choose full access, a personal watermark with the reader's name, no printing, or view only.
Short-lived links: Download links expire after one hour.
Activity log: Sign-ins, votes, decisions, downloads, exports and the first opening of each paper are recorded in a log that cannot be edited or deleted.

Your data, and when a contract ends

Ownership: Your board data belongs to you. We process it only to provide Konsaro, on your instructions.
Export and deletion: After the contract ends, you can export your data for 14 days. We then delete it, and backups are deleted within a further 14 days.

How we work

Incidents: If a personal data breach affects you, we inform you without undue delay and within 48 hours, and give you what you need for your own reporting duties.
Certification: Konsaro holds no security certification yet. We are preparing for ISO 27001.
Availability: Our public service status page shows whether Konsaro can be reached right now.

Documents

Reviewing Konsaro for your board?

We walk your IT, security and board office teams through Konsaro and answer the open questions.

Request a security review