Security
BOOSTD security: how we protect your website and data
Separate workspaces, encrypted logins, protected pages, your OK on big changes and one-click undo. How each safeguard works, and how far it has been checked.
What’s protected
Six safeguards, on every plan.
You can make them stricter. Nothing can make them looser.
Your data stays separate
Every record belongs to one business’s workspace, and every query stays inside it.
Logins stay encrypted
Access to your Google, website or CRM accounts is stored encrypted, never in plain text, logs or your browser.
Only the access we need
We ask for the narrowest permission a feature needs, when you first use it. Disconnecting revokes it.
Sensitive pages protected
Checkout, login, account, payment and legal pages are off limits by default.
Big changes wait for you
Anything published in your name, anything that spends money and anything on a protected page needs your OK.
Every change can be undone
A copy is saved before each change, the live page is checked after, and one click puts it back.
Protected pages
The pages we never touch without you.
For a marketing tool, the likeliest harm isn’t a breach. It is an unwanted change to a live page that takes money or logs people in. So these are fenced off from the start.
- Checkout and payment pages
- Login and account pages
- Legal and privacy pages
- Regulatory pages
- Any page or rule you add yourself
During the 7-day trial, nothing on your website changes except up to 3 simple fixes you approve (a page title, a description, an image description or a sharing preview), each checked afterwards and undoable in one step. Checkout, login, payment and legal pages are never touched.
Approvals and undo
How every website change is made.
The same four steps, whether the change was automatic or one you approved.
Save a copy
Before anything changes, the page as it is now is saved.
Ask when it matters
If the change alters what you say, spend or promise, it waits in your approvals.
Check the live page
After publishing, the live page is checked. Nothing is reported done until it passes.
Undo in one click
If the check fails, the change rolls back. You can also undo any change yourself.
Data handling
What happens to your data.
The short answer: it is used to do your work, it stays in your workspace, and it is never sold or used to train AI models.
- AI models
- Used through providers’ commercial APIs, whose terms exclude training on your data by default. We don’t opt in, and we send only what a task needs.
- Secrets
- Passwords and access tokens are never sent to an AI model and never written to a log.
- Web pages and reviews
- Treated as data to analyse, never as instructions, so a page can’t tell our software what to do.
- Who can see it
- You can see who has access to your workspace, including any agency staff.
- Disconnecting
- Removes our access at the provider, not just from view.
- Card details
- Entered on Stripe’s own pages. We never store them.
- Sub-processors
- No published list yet. Its status is in the trust centre.
Where it stands
Built and tested. Not yet independently checked.
How it is built and who has checked it are separate questions. Here is the honest answer to both, from our build checklist (September 2026).
Not held yet
- No SOC 2 report; readiness is planned
- No ISO 27001 certification
- No external penetration test
- No uptime figure or service-level agreement
- No security disclosure address yet: use the contact page
- Separate workspaces
- Built into the data layer and tested in development.
- Encrypted logins
- Encryption is built and tested. The production key-management service is not connected yet.
- Least access
- The connection framework is built and tested against simulated providers.
- Protected pages
- Protection rules and pre-publish checks are built and tested against a simulated website.
- Approvals
- The approval engine and the approval screens are built and tested with example data.
- Audit log
- Designed so entries can only be added, never changed, and tested in development.
- Save, check and undo
- Built and tested against simulated websites.
- Outside verification
- None yet: no certification, audit report or penetration test.
Questions
Common questions about BOOSTD security
- Does BOOSTD hold SOC 2 or ISO 27001 certification?
- No. We hold no security certification or outside attestation, and we haven’t had an external penetration test.We are building to pass an audit, and SOC 2 readiness is planned. A certification will only appear in the trust centre once an auditor issues it, with its scope stated.
- Will my data be used to train AI models?
- No. When a task needs an AI model, we use the provider’s commercial API. Those terms say API data isn’t used for training by default, and we don’t opt in.We send only what a task needs. Passwords, access tokens and other secrets are never sent.
- Can BOOSTD change my website during the trial?
- Only up to 3 simple fixes you approve: a page title, a description, an image description or a sharing preview, built from your own page, never on checkout, login, payment or legal pages. Each is checked afterwards and can be undone in one step. Nothing else is published, edited or redirected.
- What access does BOOSTD need to my accounts?
- Only what each feature needs, asked for when you first use it. Connect a Google account, for example, and we ask only for what your report needs.You can see each connection’s permissions and last activity. Disconnecting removes our access at the provider, not just from view.
- Has anyone outside BOOSTD checked all this?
- Not yet. Everything on this page is built and tested by us; no auditor or outside tester has checked it.When that changes, the trust centre will say what was checked, by whom and when.
Security questions
Ask us anything about how BOOSTD is built.
Working through a vendor checklist? Tell us what it needs. We will answer each item, including the gaps.
Email hello@tryboostd.com or call 647-896-7674.
If a part isn’t built yet, we will say so.
Last updated · Published by Zubair Afzal, responsible editor