Security | Boske

What we do to protect your content, stated plainly, with the gaps named. Everything on this page describes what is built today — nothing here is a roadmap.

Hosting and data location

Boske runs in three shapes, and the shape decides where your content lives. Local runs entirely on your own hardware. Cloud is a managed multi-tenant service in Hetzner's EU data centres in Germany. Private Cloud and On-Premise run on a server you control — for an education pilot, that is the institution's own server from the first day. There is no data-residency switch: residency is a property of the deployment you choose.

Model access and training

Your content is never used to train a model. Cloud inference is served by Mistral AI in France, reached only through our own gateway, which is the single outbound path for model traffic. No other model provider receives your content. The sub-processors page lists every third party that processes personal data on our behalf.

Access and audit

Administrative actions — licence and seat changes, invitations, role changes, policy overrides — are written to an append-only log whose records are linked by a hash chain, so a deleted or altered record is detectable. An organisation's owners and admins can read and export their own organisation's log from the dashboard. Verifying the hash chain itself is an operator procedure we run on request; it is not a self-service button.

Data-subject rights

You can export and delete your content from the product. For requests under the GDPR — access, rectification, erasure, portability, objection — write to us and we will handle it. Our data promise and privacy policy set out what we collect and why.

Reporting a vulnerability

Report a suspected vulnerability to security@boske.dev. Please give us enough detail to reproduce the issue, and please do not test against other customers' data. Our machine-readable contact details are published at /.well-known/security.txt. We will acknowledge your report and keep you informed; we do not currently run a paid bounty programme.

What we do not have yet

Things a security questionnaire will ask about that we do not have. We would rather you learn this here than halfway through a procurement process:

No SOC 2 report and no ISO 27001 certification.
No third-party penetration test has been carried out.
No uptime commitment as a percentage. What we commit to is best effort, a named contact and a stated response time.
No restore drill has been performed end to end, so we quote no recovery time.
Single sign-on is available for Private Cloud and On-Premise only. The shared Cloud has no SSO path.
No SCIM or directory synchronisation. Members are invited, and single sign-on provisions them on first login.
A data-processing agreement is available on request; a published, countersigned template is still in preparation.