Understand how BoardKite supports ongoing board operations beyond document sharing.
Legal
Sub-processors
The third parties that process customer data for BoardKite, what each one does, and when it is used. We update this list before we add or replace a sub-processor. We will normally give organization owners at least 30 days’ notice by email before a new sub-processor starts processing Customer Data, unless an urgent security or legal reason requires a shorter period.
Last updated: 22 October 2026
Used for every organization
These providers run the service. Files and sensitive fields are encrypted with your organization's own key before they reach our database or file storage.
| Provider | Purpose | Data | Location | When used |
|---|---|---|---|---|
| Vercel Inc. | Hosting, application servers, content delivery, scheduled jobs and DNS; optionally an isolated sandbox for converting Office files to PDF | All customer data while it is processed; IP addresses and request logs | European Union (application servers in Frankfurt); content delivery worldwide | Always |
| Neon | PostgreSQL database | All customer data (sensitive fields encrypted with your organization's key) | European Union (Frankfurt, eu-central-1) | Always |
| Cloudflare R2 (Cloudflare, Inc.) | File storage | Uploaded files and their versions, PDF renditions and dataroom data packs, all encrypted with your organization's key before storage | European Union | Always |
| Resend | Sending product email, and receiving replies to agenda feedback emails | Recipients' names and email addresses, email content (for example meeting titles, room names and invitation text) and the text of replies | European Union (Ireland); Resend may use sub-processors in other countries | Always |
| Anthropic, PBC | BoardKite-hosted AI | The context of an AI request, limited to what the person asking may see: questions, meeting, agenda, minutes, decision and objective text, names, file names (not contents, except the governing documents an admin asks it to read for the legal profile) and transcripts used for a minutes draft. Never datarooms or personal notes. | United States | When AI is on (the default) and someone uses an AI feature. An admin can turn AI off for the organization. |
| GitHub, Inc. | Running BoardKite's production operations (database migrations, key rotation, support procedures); when switched on, filing in-app feedback as issues in our private repository | Customer data processed during those operations; for feedback: the message, the page it was sent from, the organization id and the sender's contact email | United States and other countries where GitHub and its sub-processors operate | Operations: always. Feedback: whenever someone sends in-app feedback |
| PostHog, Inc. | Product analytics | A pseudonymous user id, the organization's id (not its name), product events, IP address and browser details. No session recording. | European Union | Events about a person, in the browser or from our servers, only after that person accepts analytics cookies; billing events are recorded for the organization, not a person |
| Google LLC — reCAPTCHA | Protecting sign-in, sign-up and password reset forms from automated abuse; loaded only when one of those forms is used | IP address and browser signals on those forms | United States | On those forms |
| Stripe | Payments and subscriptions | The billing contact's email, the organization id and plan, and the billing name, address and tax ID the customer enters at Stripe; card details are entered at Stripe and never reach BoardKite | European Economic Area (contracting entity in Ireland), United States and other countries where Stripe operates | When an organization buys or manages a subscription |
| ImprovMX | Forwarding email sent to BoardKite's own addresses (for example support and hello) | Messages you send us and the addresses they come from | France and the United States | When you email us |
Used only when your organization turns a feature on
Nothing is sent to these providers unless the feature is in use.
| Provider | Purpose | Data | Location | When used |
|---|---|---|---|---|
| Google LLC — Calendar and Meet | Creating and updating calendar events and Meet links for your meetings | The connected account's email; meeting title, time, description, location or video link and attendees' email addresses; free/busy lookups | The region selected for the connected Google account; limited processing may occur worldwide | Only when a member connects a Google account |
| Microsoft Corporation — Outlook calendar and Teams | Creating and updating calendar events and Teams meetings | The connected account's email; meeting title, time, description, location or video link and attendees' email addresses; free/busy lookups | The region selected for the connected Microsoft tenant; limited processing may occur worldwide | Only when a member connects a Microsoft account |
On our public website
Not used inside the app for signed-in members.
| Provider | Purpose | Data | Location | When used |
|---|---|---|---|---|
| Google LLC — Google Analytics | Measuring visits to the public website | Pages visited and browser details; analytics cookies only after consent where consent is required | United States | Website visitors who aren't signed in |
Services you connect yourself
These run under your organization’s own account and contract, not BoardKite’s, so they are not our sub-processors. We list them so your review is complete.
- Your own AI provider, if you connect one instead of BoardKite-hosted AI: Anthropic with your own key, OpenAI, Azure OpenAI or a self-hosted model.
- Recall.ai, if you connect it with your own key to record and transcribe meetings (its default region is the United States).
Board software pages related to trust and vendors
Connect this subprocessor list to board portal, governance, and use-case pages used during software evaluation.
See how BoardKite connects meetings, decisions, files, and governance records in one portal.
See how Board Copilot plans agendas, drafts minutes, and answers governance questions.
Review agenda planning, meeting execution, and minutes workflows.
See how BoardKite assembles the board book from agenda items and documents.
Track decision owners, deadlines, and follow-through between meetings.
Explore controls for auditability, approvals, and governance traceability.
Learn how teams draft, approve, and retain board minutes with less friction.
Lean governance workflows for founder-led teams and early boards.
Structured governance for growth-stage teams with increasing complexity.
Transparent board operations for trustees and mission-driven organizations.
Improve board reporting and decision accountability for high-expectation stakeholders.