Security

Last updated: 5 November 2026

Evidence Board holds case files: often other people's personal data, sometimes sensitive. This page says how we protect them, and what we don't have yet. It describes the service as it runs today. For what we collect and why, see the Privacy Policy; for firms working on clients' data, our Data Processing Agreement.

Where your data lives

• Database, files and sign-in: Supabase, in London, UK.
• The app: Vercel, with its server functions in London. Our public pages are also served from Vercel's global network; they hold no case content.
• Nightly backups: see "Backups" below.

Other providers, and what each one handles, are listed in the Privacy Policy under "Who we share data with".

Encryption

• In transit: every connection to Evidence Board and to our database and file storage is over HTTPS (TLS).
• At rest: Supabase encrypts the stored database and files (AES-256, as Supabase documents for its platform).
• Backups are encrypted before they leave the server that makes them, with a key that only we hold, offline.

Who can see a case

• A case belongs to the person who made it. Nobody else sees it until they share it.
• Invited people see it as a viewer (read only) or an editor (can change the board). Only the owner deletes a case, shares it or changes who's on it.
• Confidential items: an owner can mark items confidential. A viewer doesn't receive them, nor their links, events or files, unless the owner lets them.
• Teams and organisations: a case is shared with a team, or with colleagues at your email domain, only when its owner chooses.
• Share links are read-only and work only while sharing is on; the link holds a long random token, and turning sharing off stops it at once.
• These rules are enforced by the database itself (Postgres row-level security), not just by the app's screens, so a request for a case you can't see returns nothing.

We don't look at your case content unless you ask us to (for example, in a support request) or the law or the security of the service requires it.

Files

Uploaded files are kept in private storage. They're never at a public address: each time a file is shown, the app makes a link to it that expires after an hour, and only for someone allowed to see that case. Links in an account export last 24 hours.

Signing in

• Passwords are handled by Supabase Auth and stored hashed, never in plain text. You can also sign in with Google.
• Two-step sign-in (optional): turn it on in your account, with an authenticator app on your phone. After your password or Google, the website asks for a 6-digit code. You can trust a browser for 30 days so it doesn't ask there every time; connecting an assistant and setting a new password always ask. Removing an authenticator, or Sign out everywhere, stops trusting every browser.
• Lost your phone? Email us from your account's address; we check it's you before turning two-step sign-in off.

Assistants you connect

ChatGPT, Claude, Gemini, Grok or Perplexity connect to your account only after you sign in and approve them. Each one acts as you: it reaches only the cases you can, with your role in each. You can see and disconnect connected apps on your account page, which stops their access at once. See AI and your data.

Deleting and exporting

• Export everything we hold about you from your account page, as a file, with links to your uploaded files.
• Delete a case, or your whole account, at any time. Deleting removes it from the database and file storage straight away (a very large case disappears at once and is removed in the background). Copies in our encrypted backups are deleted within seven days.

Backups

Every night the database and all uploaded files are copied, encrypted, to separate storage (Cloudflare R2, which we set to Western Europe). Each copy is deleted after seven days.

Error reports

When something fails, the app sends a technical error report to Sentry (stored in the EU). It's set not to collect IP addresses, cookies or request contents, and records no sessions or screens.

If something goes wrong

If we find a personal data breach, we:

• contain it and find out what happened;
• report it to the Information Commission (the UK regulator) within 72 hours of becoming aware of it, where the law requires us to;
• tell the people affected without undue delay when it's likely to put them at high risk;
• for case content, tell the account owner without undue delay, so they can meet their own duties as controller.

Reporting a security problem

Email support@mtgtechnical.com with what you found and how to reproduce it. A person reads every message, usually within one working day. Please don't access other people's data or disrupt the service while testing; we won't take action against anyone who reports a problem in good faith this way. We don't offer payment for reports. Our security.txt has the same contact.

What we don't have yet

We're a small company, and we'd rather say so plainly:

• We hold no security certification of our own (such as ISO 27001 or SOC 2), and haven't had an independent penetration test.
• A team can't yet require two-step sign-in for its members, and there's no single sign-on (SAML).
• There's no choice of where data is stored: it's in the UK.

If your organisation needs something here before using Evidence Board, email us.