Trust

Read-only. Never trading. Always encrypted.

Your data stays under your control.

Investboard is built for context, not execution. We protect your data with modern encryption standards, strict access control and European data residency: transparent and verifiable.

Data protection

Data protection & data residency

Data-protection processes under GDPR and BDSG for personal data
EU regions for core infrastructure, with details in the privacy policy
Minimal data collection: only what is necessary for functionality
No sale and no disclosure of user data to third parties
A transparent privacy policy with clear legal bases

AI & data protection

Model calls have additional boundaries: six clearly named uses, a geographically bound EU profile and technical guardrails.

See how we use AI

Access

Authentication & access

Authentication via Clerk, with JWT sessions validated by Supabase
Two-factor authentication (TOTP) available
Secure session management with automatic token refresh
Row Level Security at the database level: each user sees only their own data
Rate limiting against automated sign-in attempts and abuse

Infrastructure

Infrastructure & encryption

Hosting with EU regions for core infrastructure
TLS encryption for all connections (HTTPS everywhere)
Field-level encryption with AES-256-GCM for especially sensitive data
Automated backups and disaster-recovery procedures

Hardening

Application & operations

Strict input validation with Zod for all API inputs
Content Security Policy and security headers
CSRF protection for all state-changing operations
Error monitoring and alerting via Sentry
Audit logging together with automated dependency and secret scanning in the CI/CD pipeline
Separate development, staging and production environments, access on a least-privilege basis

Read-only

Investboard reads. It does not act.

Data processing

Which data, and which not

Transparency about which data is collected, and which is deliberately not.

Collected: email address, portfolio data, import files, usage statistics
Not collected: bank details, brokerage credentials, trading data
Investboard executes no transactions and has no access to your brokerage accounts or bank accounts
Access to user data only by the user themselves (Row Level Security)
No disclosure to third parties, not even anonymized for advertising purposes
Optional analytics only with explicit consent

Your rights

Your rights & responsible disclosure

Data export (GDPR Art. 20): all of your own data as a structured export
Account deletion: complete and irreversible deletion of all stored data
Session management: review active sessions and end them individually
Consent management: cookie and analytics preferences adjustable at any time

We take security reports seriously and work constructively with security researchers. If you discover a vulnerability, please report it responsibly:

Report by email to security@investboard.de
Describe the vulnerability as precisely as possible
Give us reasonable time to remediate before you publish any information
We confirm receipt within 48 hours

Please do not run automated scans against production systems. Talk to us beforehand.

GDPR data protectionEncrypted in transitEU hosting

Start securely

See for yourself. Investboard protects your data, from the very first click.

Set up my mandate View demo