Security

Authentication and account protection

Passwords are hashed with bcrypt (cost 12). We never store them in the clear.

Two-factor authentication using authenticator-app (TOTP) codes, with one-time backup codes, is available on every account and is required for workspace owners and administrators. The TOTP secret is stored encrypted (AES-256-GCM) and is never returned to your browser after setup.

Sessions use httpOnly, same-site cookies that are secure in production. Refresh tokens rotate on use, and a password reset revokes every existing session. Session and one-time tokens are stored only as SHA-256 hashes.

Unauthenticated sign-in endpoints reject cross-site browser requests.

Roles and permissions

Each customer’s data lives in its own workspace. A person who joins a workspace directly holds one of four roles:

Owner — can view the company’s data, add and change it, and manage members, their roles, invitations and workspace settings.

Admin — can view the company’s data, add and change it, and manage members, their roles, invitations and workspace settings.

Member — can view the company’s data and add and change it; cannot manage members or settings.

Viewer — can view the company’s data; cannot change data or manage members or settings.

An invited team member is given access section by section — Financials, Clients, Sales, Team & HR, Roadmap, KPIs, Business Lines, Market Intel, and Decisions — at one of four levels: Manage files (can view the section and add, re-analyze, or remove files), Read only (can view dashboards and source files, but cannot change them), Limited read (can view high-level dashboards, but not raw files or sensitive details), and No access (cannot view this company section). An invited member is governed by those grants, never by a workspace role.

In Decisions, asking for a decision and making one are separate permissions: read access lets a person file a request and follow it, and deciding needs Manage access. Nobody can decide a request they filed themselves, except the workspace owner.

Administrative functions of CEODash itself are gated to an admin role on our side, separate from any workspace role.

These permissions are checked on our servers when a section’s data is read or changed, not only hidden in the interface.

Data protection

In transit: all traffic is served over TLS.

At rest, encrypted at the application layer with AES-256-GCM: your uploaded financial and HR files, and any third-party access tokens you connect.

At rest, everything else: stored in our managed database and encrypted at rest by our infrastructure provider.

Hosting, data location, and sub-processors

CEODash’s application, cache, and embeddings run on Hetzner infrastructure in Helsinki, Finland (EU). Our managed customer database and file storage run on Supabase in the Stockholm, Sweden region (eu-north-1), so your data is stored in the EU.

EU or US data residency is available for paying customers on request.

Today every paying customer is already on the EU option: compute in Helsinki, Finland, and the customer database and file storage in Stockholm, Sweden. A request for the US option, or for a specific EU country, is arranged in your contract and handled case by case — we confirm in writing what we can do for your region before you commit to anything, and we will tell you plainly if the answer is no. Ask through the trust-package form on this page.

Sub-processors we use: Hetzner — hosting and compute plus DNS — Helsinki, Finland (EU). Supabase — database and file storage, the primary customer-data store — Stockholm, Sweden (EU). Anthropic — AI processing for the in-product assistants — United States (cross-border). Stripe — payments and subscription billing — US / global (cross-border). Resend — transactional email such as verification and password reset — US (cross-border). ImprovMX — inbound support-email forwarding — region being confirmed (cross-border).

Also in the processing chain: Google is engaged only if you connect Google (Calendar/Gmail), a private-beta integration, and not otherwise; GitHub / GHCR hold our source and builds, not your application data by default; Cloudflare hosts an internal DevOps tool that receives administrator-filed diagnostics, and the customer app itself does not run on Cloudflare.

Cross-border transfer, stated explicitly: your data is stored in the EU, but AI processing (Anthropic) occurs in the United States. Payments (Stripe) and transactional email (Resend) are US / cross-border. If you connect Google, that processing is global.

Voice input (beta): when you dictate, your recording is turned into text by CEODash’s own speech service on our Hetzner servers in Helsinki, Finland (EU). No third party receives the audio. The recording is held in memory only while it is transcribed and is then discarded; neither the audio nor the transcript is stored or written to logs. The text only fills the field you dictated into, and nothing is sent until you press that field’s button.

Who can access production

Deployments are automated through CI over SSH; production secrets live in restricted server files.

Access for AI assistants (MCP)

MCP is in preview and switched off unless we enable it. When it is on, an outside AI assistant reads your workspace through a key that a workspace owner or administrator issues in Settings. We store only a hash of the key; the key itself is shown once, at issue.

A key acts as the person who issued it: it reads only what that person may read, only in that workspace, and stops working if they leave the workspace or their account is frozen. It can be narrowed to some sections and given an end date, and it can be revoked at any time — revocation takes effect on the next call. Every issue, revocation and read is recorded in the audit trail.

Logging and your audit trail

We record an audit log of security-relevant actions — sign-in and sign-out, file uploads, downloads and deletes (including data exports), integration connect and disconnect, password resets, two-factor events, and data reads made through our MCP server.

Retention: audit-log entries are kept for 12 months (365 days) and then deleted automatically.

Your own copy: a workspace owner or administrator can export their workspace audit trail as a CSV from Settings, without asking us.

Backups and recovery

Our cache/queue store is snapshotted daily and retained 14 days.

Our primary database is protected by our own backup system: every night we take a complete copy of it, keep thirty days of them, and store them on separate infrastructure from the database itself, so losing the database provider is not a total loss.

Every copy is read back and verified before it is kept, because an archive nobody opens for six months is how this kind of promise quietly becomes false. The restore itself is exercised on a schedule, not assumed: on 24 September 2026 a full copy was restored into a fresh database and accepted the current schema, and the same check runs again each quarter.

Incident response

We have an internal incident-response process, with severity levels and a containment-first sequence.

Notification: if an incident touched your data, we tell you within 72 hours of becoming aware of it. The clock starts when someone here knows — not when we have confirmed the scope, not when it is contained. A suspicion we rule out is not an incident; a suspicion we have not ruled out within 72 hours is, and you hear about it with what we know and what we do not.

The notification says what happened, when we became aware, which data was involved and whether yours was among it, what we have done, what you should do, and when the next update is due. If we cannot yet tell whether your data was affected, we say that rather than implying it was not.

It reaches the workspace owner by email, and any address you give us for security notices — not an in-app banner alone, because someone who is not signed in that week still needs to know. The founder is accountable for the decision to notify and for what it says.

What the AI can read

An AI answer is limited to what the person asking is allowed to see. Their section access is resolved before any context is assembled, and data they may not read is never fetched — so a section a member cannot open on the page is not reachable by asking the assistant for it either.

Pay and bank details are never sent to the model, for anyone, including the workspace owner. A workspace can exclude further sections or fields of its own in Settings; that setting can only narrow what is sent, never widen it.

The model provider is Anthropic, which does not train on data sent through its API.

Your data rights

Export: you can export your workspace’s data — the raw records from every source you connected, plus the normalised financial model — as a single file from Settings, at any time.

Deletion: you can delete uploads and disconnect integrations from within the product; disconnecting an integration invalidates the stored access token.

Deleting an upload erases the stored original file in the same action, not on a later schedule. Originals that you do not delete are erased automatically 30 days after upload; the figures parsed from them stay, because they are what the product renders.

Questionnaires and the trust package

We are happy to complete your security questionnaire and to provide our current trust package. Request it with the form below.