Security & Compliance at Boldcaster
Boldcaster holds things you wouldn't want anywhere else: your strategy, your numbers and how your people are performing. You deserve a clear answer about where all of that goes.
Our AI is European. Your business data is analysed by Mistral in France, and call recordings are handled by tl;dv in Germany. No American AI touches your data.
How we protect your data:
100% EU Hosted & GDPR Compliant
Your company data stays within the European Union. The database (Supabase) is in Ireland and the servers (AWS) are in Frankfurt, Germany, which means we comply with the GDPR. Boldcaster is a Dutch company and our domain is held with the Dutch provider TransIP.
A few services run outside Europe. Calendly books meetings and Stripe handles payments; they see a name, an email address and a time. Resend sends our emails, such as an invitation or a reminder; it sees the address and what the email says. If you sign in with Google or Microsoft, the sign-in runs through them. On the public site we measure visits with Google Analytics, not in the app. We would rather tell you upfront than leave you to find out for yourself.
European AI, not American
The AI that analyses your strategy, numbers and team is Mistral, a French company that processes data on servers in the EU. No American provider, no American parent company, so no questions about the CLOUD Act. Call recordings are handled by tl;dv, a German company that stores data in European data centres.
Training on your data is switched off, and we can show you that setting. Just ask. Your strategy, your numbers and your reviews are never used to train models.
Employee names are never sent out
The quarterly report looks at how your people are performing. That is exactly the kind of information you don't hand out lightly. So we replace names with a neutral label before anything goes to the AI, and only put them back inside the app.
The AI provider can see that someone is behind on their goals, but not who it is. In the app you simply see the name. An automated test guards this and fails the moment a name slips through.
Infrastructure
The Boldcaster database runs at Supabase, on Amazon Web Services (AWS). Those data centres are ISO 27001 certified. In front of the site, Cloudflare stops DDoS attacks and malicious traffic. We manage our own servers with Coolify.
Signing in and encryption
You sign in with email and password, or with your Google or Microsoft account. On top of that there is two-factor authentication: anyone can switch it on, and the owner can make it mandatory for the whole organisation. All traffic between your browser and our servers is encrypted with TLS, and the data in the database is encrypted at rest (AES-256, at Supabase).
Every environment stands on its own
Boldcaster runs on one platform with one database. Who can access which data is decided by the database itself, not by the screen you see. Every table has row-level security: a request for another organisation's data simply returns nothing, even if someone bypasses the application.
The same applies to partners who use Boldcaster to support their own clients. A partner manages the environments in their own portfolio and demonstrably cannot reach anything else. Their clients cannot see each other, and the partner does not appear as a member of their client's team. We check this with a fixed set of tests that fails the moment a door is left open anywhere.
Connecting your own AI is up to you
You can use Boldcaster from Claude, ChatGPT or Vibe. That connection is off by default. An owner switches it on per organisation, chooses which parts the AI can see, and decides whether it may also create things.
Whatever your AI requests goes to that app's provider. For Claude and ChatGPT that is a US company; for Vibe by Mistral, a European one. Boldcaster itself sends nothing outside Europe. The AI never sees more than the person who connected it, every request is recorded in a log you can view, and you can revoke access in one click. How the AI connection works.
Questions?
Does your IT team have specific questions? Get in touch via security@boldcaster.com.