Security
How we protect your research data: encryption, tenant isolation, UK hosting and GDPR compliance.
Last updated: October 2026
1. Overview
AllocBoard is built for research teams managing sensitive staff and financial data. This page outlines the technical and organisational measures we use to protect your data. If you have questions, contact us at hello@allocboard.com.
2. Infrastructure
Core application data is hosted in the United Kingdom.
- Database hosted on Neon PostgreSQL in the aws-eu-west-2 (London) region
- Application servers hosted on Google Cloud in the europe-west2 (London) region
- Website and CDN delivered by Cloudflare's edge network
- All connections encrypted with TLS 1.2 or higher
- HTTPS enforced across all endpoints, with HSTS headers on the API and this website
3. Encryption
We use field-level encryption to protect sensitive personal and financial data at rest.
- AES-256-GCM encryption for sensitive fields including names, emails, and salaries
- Per-tenant encryption keys, so each organisation's data is encrypted with its own key
- Blind indexes (HMAC-based) enable search over encrypted data without decryption
- Encryption keys are managed separately from application data
4. Database security
We enforce strict tenant isolation at the database level.
- Row-Level Security (RLS) policies active on all tenant data tables
- Every database query is scoped to the authenticated user's organisation
- No cross-tenant data access is possible, even in the event of an application-level vulnerability
5. Compliance
AllocBoard is designed to meet UK GDPR requirements.
- Built-in Data Subject Access Request (DSAR) handling: users can export all personal data in one click
- Comprehensive audit logging with automatic masking of sensitive fields
- Personal data of a removed staff member or user permanently anonymised within 30 days, and a closed workspace permanently erased 30 days after closure
- Audit log retention set by plan: kept for the life of the account on paid plans and 1 year on the free trial
- Data Processing Agreement available at /dpa
6. Application security
We implement comprehensive web application security controls.
- Rate limiting on all API endpoints
- HTTP Strict Transport Security (HSTS) headers on the API
- X-Frame-Options headers to prevent clickjacking
- CORS policies restricting cross-origin requests
- Authentication and session management via Clerk
7. Data retention
We follow clear data retention and deletion policies.
- Account data retained while the account is active
- Workspace retained read-only for 90 days after a trial ends, then closed
- Workspace retained read-only for 12 months after a paid subscription ends, then closed
- Organisation deactivated from a Portfolio retained for 12 months, then closed, and can be reactivated through support until then
- Every Manager emailed about 30 days and about 7 days before a read-only workspace is closed; subscribing again before then restores editing
- A closed workspace is permanently erased 30 days after closure, audit logs included
- Staff records removed from the application on deletion, with personal data permanently anonymised within 30 days
- Audit logs retained for as long as your account is open on a paid plan, or 1 year on the free trial
- Audit logs permanently deleted 90 days after their retention period expires
- Database backups retained for 7 days for disaster recovery
8. Sub-processors
The following third parties process personal data on our behalf to operate AllocBoard. Where sub-processors are based outside the UK, transfers are governed by the UK International Data Transfer Agreement (IDTA) and EU Standard Contractual Clauses (SCCs) as applicable. Anthropic, which provides the language model behind Ask Alloc, processes data under its Data Processing Addendum, which forms part of its Commercial Terms and incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
| Service | Purpose | Location |
|---|---|---|
| Neon | Database hosting and infrastructure | London, UK |
| Google Cloud | Application server hosting | London, UK |
| Clerk | User authentication and session management | United States |
| Stripe | Payment processing | United States |
| Resend | Transactional email | United States |
| Anthropic | Language model for Ask Alloc and import column suggestions (only where Alloc Intelligence is on: included on Group and Portfolio, an add-on on Solo) | United States |
| Sentry | Error monitoring and in-app problem reports | Germany (EU) |
| Cloudflare | Application and website hosting, CDN, reverse proxy and bot protection | Global (edge network) |
9. Incident response
We maintain an incident response process to handle security events promptly.
- Affected customers will be notified within 72 hours of a confirmed data breach, in line with UK GDPR requirements
- Incident reports include the nature of the breach, data affected, and remediation steps taken
- Post-incident reviews are conducted to prevent recurrence
10. Security reviews
We conduct regular security reviews of our infrastructure and application code. This includes dependency auditing, code review, and periodic assessment of our security controls.
11. Backup and disaster recovery
Database backups are taken daily and retained for 7 days. Our infrastructure is designed for high availability with automated failover. In the event of a major incident, we target recovery within 24 hours.
12. Internal access controls
Access to production systems and customer data is restricted to essential personnel only. All access is logged and reviewed. We follow the principle of least privilege across our infrastructure.
13. Contact
For security questions, concerns, or to report a vulnerability, please contact us.
Email: hello@allocboard.com