Security
How BOOSTD is built to protect your business and your data
The security model BOOSTD is being built to, with the current state of each part beside it. BOOSTD holds no security certification, and this page does not pretend otherwise.
Prefer to talk it through? Book a strategy call
Read this first
How BOOSTD is built, and what has been independently verified
A security page usually answers two different questions at once and lets the reader assume the answers are the same. This one keeps them apart.
The first is how BOOSTD is built: the rules the system is designed around, such as keeping each business’s data separate, encrypting the credentials you connect, and refusing to change a protected page without a person. Those are real design commitments and most of them exist as working, tested code today.
The second is what an independent party has verified. Today the answer is nothing. BOOSTD has no security certification, no audit report and no external penetration test, and the platform is not yet running in production. When that changes, the trust centre will say exactly what changed and who verified it.
The security model
Eight design commitments, and where each one stands
“Where it stands” is taken from our own implementation checklist, which marks anything tested only against simulated services as not yet complete.
| Dimension | What it means for you | Where it stands |
|---|---|---|
| Each business is kept separate | Every record belongs to one business’s workspace, and every query is scoped to it. Agency staff see only the client workspaces they are assigned to. | Workspace scoping is built into the data layer and tested in development. Not yet run on a production database. |
| Connected credentials are encrypted | Access tokens for your Google, CMS or CRM accounts are stored encrypted, never in plain text and never in logs. They never reach your browser. | Encryption is implemented and tested. The production key-management service is not yet connected. |
| Least-privilege connections | BOOSTD asks for the narrowest permission each feature needs, at the moment you first use it. Disconnecting revokes access at the provider. | The connection framework is built and tested against simulated providers. No real account has been connected. |
| Sensitive pages are protected | Checkout, login, account, payment, legal, privacy and regulatory pages are protected by default. You can add your own pages and rules. | Protection rules and preflight checks are built and tested against a simulated website. |
| Material changes wait for approval | Anything published in your name, anything that spends money and anything touching a protected page waits for a person, however confident the system is. | The approval engine is built and tested. The screens you would approve from are not built yet. |
| Every action is recorded | Logins, connections, approvals, publishes, exports and any staff access to your account are written to an append-only audit trail. | The audit trail is designed as append-only and tested in development. It is not yet running on production storage. |
| Every change can be undone | Before a website change, BOOSTD stores what the page was. After it, BOOSTD checks the live page and rolls back if the check fails. | Snapshot, verification and rollback are built and tested against a simulated website. No real CMS is connected. |
| No training on your data | BOOSTD does not train models on customer data, and uses model providers under commercial API terms that exclude training by default. | Provider data-use settings are part of model routing configuration. No model has yet been called with customer data. |
Rules that do not bend
What BOOSTD is built to do, and what it will never do
These hold whatever plan you are on and however confident the system is. A business can make its own rules stricter; nothing makes them looser.
Always
- Check your plan and budget before any costly work, and stop rather than silently overspend
- Keep a before-state for every website change, and check the live page afterwards
- Show each connection’s permissions, status and last activity
- Treat crawled pages, reviews and comments as data to analyse, never as instructions
- Send model providers only what a task needs, with secrets and tokens removed
- Let you see who has access to your workspace, including agency staff
Never
- Edit your website during a trial
- Change checkout, login, payment or legal pages without explicit approval
- Report a change as live before the live page has been checked
- Store an access token in plain text or write one to a log
- Mix one business’s data into another business’s results
- Claim a certification or audit before it has been issued
Stated plainly
Certifications and figures BOOSTD does not have
Buyers are right to ask for these. The honest answer today is that none exists, and a missing item is more useful to you stated than implied.
- No SOC 2 report. SOC 2 readiness is planned, and an audit will be commissioned when it is justified.
- No ISO 27001 certification.
- No external penetration test yet.
- No uptime figure or service-level agreement, because there is no production service to measure yet.
- No published status page, subprocessor list or data processing agreement yet. The trust centre tracks each one.
- No dedicated security disclosure address or programme yet. General questions reach a person through the contact page.
What applies right now
What BOOSTD holds about you today
Because the platform is not open, BOOSTD holds no customer workspaces, no connected accounts and no stored credentials for anyone’s website, analytics or advertising.
What exists today is this website. It collects what you send through the enquiry form and, with consent where consent is required, analytics about which pages are used. The privacy policy covers both, and requests to see or delete your information go to hello@tryboostd.com.
Current clients work with us directly, under the terms agreed for their engagement, rather than through the platform.
Questions
What reviewers ask before granting access
Does BOOSTD hold SOC 2 or ISO 27001 certification?
No. BOOSTD holds no security certification or independent attestation of any kind, and has not had an external penetration test.
The platform is being built so that an audit could be passed, and SOC 2 readiness is on the plan. A certification will appear on the trust centre only once an auditor has issued it, with the report scope stated.
Will my data be used to train AI models?
BOOSTD does not train its own models on customer data. Where a task needs a language model, BOOSTD calls the provider through its commercial API, whose terms say API data is not used for training by default, and BOOSTD does not opt in.
BOOSTD also sends only what a task needs. Passwords, access tokens and other secrets are never included, and web pages or comments read during a task are treated as data to analyse, never as instructions to follow.
Can BOOSTD change my website during a trial?
No. A trial is read-only for your website by design: it scans and recommends, and it cannot publish, edit or redirect anything. Nothing has to be undone if you leave.
What access does BOOSTD need to my accounts?
The least that each feature needs, requested when you first use that feature rather than all at once at sign-up. Where you connect a Google account, for example, BOOSTD asks for the specific permission a report needs and nothing broader.
You can see each connection’s permissions and last activity, and disconnecting revokes access at the provider rather than just hiding the connection.
Is any of this running today?
Not in production. The platform is in early access and no customer can yet connect an account or give BOOSTD access to a website. The table on this page gives the state of each part.
Current clients work with us directly, and their work is not run through the platform.
Have a security question this page does not answer?
Send it through the contact form. A person reads it, and if the honest answer is “not built yet”, that is the answer you will get.
Last updated · Not yet approved for publication