Trust Center
How Konsaro protects your board's data: where it is stored, who can reach it, and what happens to it. Written for IT, data protection and procurement teams.
Last updated: 27 October 2026
Zurich
Board data stored in Switzerland
AES-256
Encryption at rest, TLS in transit
No training
Your data never trains AI models
14 days
To export your data when a contract ends
Where your data lives
- Board data
- The database, uploaded documents and sign-in data are stored with Supabase in Zurich, Switzerland.
- Application
- The web application runs on Hetzner servers in Germany (EU).
- Backups
- The database is backed up daily, and backups are kept for 7 days in the same region.
- Email and SMS
- System emails go through Resend and sign-in codes by SMS through Twilio, both in the United States. They receive names, email addresses, phone numbers and email content, never board documents.
AI
- What it does
- Rephrasing and translating text, translating documents for attendees, and drafting help for minutes. The board office reviews every result before it is shared.
- Model and provider
- Claude models by Anthropic, reached through OpenRouter's EU endpoint with zero data retention. The provider does not keep the content of requests.
- No training
- Your board material is never used to train AI models.
- Your choice
- AI features are switched on by default. Administrators can switch them off for the whole organisation, and then no content leaves Konsaro for AI processing.
Sign-in and access
- Company sign-in
- Single sign-on with SAML 2.0, and SCIM provisioning that adds and removes accounts as your directory changes.
- Two-factor authentication
- With an authenticator app or SMS codes. Administrators can require it for sign-in by email link.
- Sessions
- Administrators can end inactive sessions automatically, for example after 30 minutes. Repeated failed sign-ins are rate-limited.
- Roles and access lists
- Role-based permissions, enforced in the database, plus access lists on single documents and agenda items.
Document protection
- Security levels
- Per document, room administrators choose full access, a personal watermark with the reader's name, no printing, or view only.
- Short-lived links
- Download links expire after one hour.
- Audit trail
- Access, downloads and data exports are recorded in a log that cannot be edited or deleted.
Your data, and when a contract ends
- Ownership
- Your board data belongs to you. We process it only to provide Konsaro, on your instructions.
- Export and deletion
- After the contract ends, you can export your data for 14 days. We then delete it, and backups are deleted within a further 14 days.
How we work
- Security testing
- We test Konsaro for security weaknesses regularly, in-house.
- Incidents
- If a personal data breach affects you, we inform you without undue delay and give you what you need for your own reporting duties.
- Certification
- Konsaro holds no security certification yet. We are preparing for ISO 27001.
- Availability
- Current service status and past incidents are on our public status page.
Documents
Sub-processors
Who helps run Konsaro, with what data and where.
Data Processing Agreement
Summary of the DPA under the revFADP and the GDPR.
Privacy Policy
How we handle personal data on this website.
Status page
Current availability and incident history.
Questions or a security report. For the signable DPA, security questionnaires or to report a vulnerability, email info@softwarevision.ch.
Reviewing Konsaro for your board?
We walk your IT, security and board office teams through Konsaro and answer the open questions.
Request a security review