BoodleBox

Security & Privacy

Updated July 2026

Privacy Organizational Security Cloud Security Access Security Vendor & Risk Management

How private is my data on BoodleBox?

BoodleBox does not train AI models, so your data will never be used by boodleAI to train an AI model.

If you use a boodleAI controlled model (such as LLAMA 2 & 3), then your data never leaves the control of boodleAI.

If you use a third party model (such as one by OpenAI or Anthropic or Google), then your prompts are provided to the third party API, but anonymized so they cannot be connected to you as an individual or to your organization.

Unlike individual accounts with model providers, where the model provider can directly connect prompts to the user and generally reserves the right to train models on data provided to them, boodleAI uses commercial/business APIs where the terms of service prohibit the use of provided data for model training.

Here are details about these specific APIs and their handling of data received through their commercial APIs:

OpenAI API: Data provided to OpenAI's API is not used to train OpenAI models and is not shared with any third parties beyond OpenAI.
Anthropic API: Data provided to Anthropic's APIs is not used to train Anthropic models and is not shared with third parties beyond Anthropic. "Customer Content is Customer's Confidential Information."
Google Cloud API: Data provided to Google Cloud's APIs is not used to train Google models and is not shared with third parties beyond Google.

Uploaded documents are encrypted and secured by boodleAI on AWS and are never shared with third parties.

How secure is BoodleBox?

BoodleBox employs industry-leading security practices like encryption in transit and at rest, access controls, audits, and SOC 2 compliance to keep customer data secure.

boodleAI received a SOC 2 Type 1 certification in 2024 and has since achieved SOC 2 Type 2 certification, which it maintains through ongoing annual audits.

boodleAI also maintains HIPAA compliance and GDPR compliance, with corresponding attestations available upon request.

What are BoodleBox's terms and policies regarding data?

They are available on our Terms & Policies page.

Does BoodleBox have the capability to administer, maintain, and/or audit role-based access control?

BoodleBox has an admin console that allows workspace and team management. The admin can designate which other team members have admin access.

Are there any identity & access management controls that can be set up? (i.e. multifactor)

The main identity and access management controls that can be set up in BoodleBox are:

User profiles and authentication via passwords — users can create profiles and set passwords to control access to their accounts.
Granular content permissions — box creators can set visibility as private, unlisted, or public and assign view-only or collaborate permissions to limit access.
Administrative controls — the admin console allows management of team membership.

MFA is on the product roadmap. In summary, BoodleBox supports core identity management via user profiles and passwords as well as access management through both content permissions and administrative team/resource settings.

If you post a contract or a quote to a group chat, where is that document stored/maintained?

The files are stored both in their raw format and their embedded format in an encrypted boodle-controlled cloud server.

What third-party systems can get that information?

The raw files are never provided to third parties in their totality.

If you use a third party model (such as one by OpenAI or Anthropic) and attach knowledge to a chat, then select relevant portions of the files are provided to the third party API, but anonymized so they cannot be connected to you as an individual nor used to train a model.

If you are using one of BoodleBox's 1,000 bots like ChatGPT, is the integration secured using encryption for data at rest and in transit?

Yes. All data on our platform is encrypted at rest and all of our external APIs are via encrypted endpoints.

Does BoodleBox have an EU and UK Data Processing Addendum?

Yes. Upon signing up and accepting the BoodleBox Terms of Service, a Data Processing Addendum is in effect.

Security at BoodleBox

Last Updated July 2026

At boodleAI, we take security seriously to protect our customers’ data. This document outlines our security practices, which we regularly review and update.

Organizational Security

Information Security Program — We have an Information Security Program in place that is communicated throughout the organization, following the criteria set forth by the SOC 2 Framework, a widely known information security auditing procedure created by the American Institute of Certified Public Accountants.
Third-Party Audits — Our organization undergoes independent third-party assessments to test our security and compliance controls.
Third-Party Penetration Testing — We perform independent third-party penetration testing at least annually to ensure the security posture of our services is uncompromised.
Roles and Responsibilities — Roles and responsibilities related to our Information Security Program and the protection of customer data are well defined and documented. Team members are required to review and accept all security policies.
Security Awareness Training — Team members complete security awareness training covering industry-standard practices and topics such as phishing and password management.
Confidentiality — All team members sign and adhere to an industry-standard confidentiality agreement prior to their first day of work.
Background Checks — We perform background checks on all new team members in accordance with local laws.

Cloud Security

Cloud Infrastructure Security — All of our services are hosted with Amazon Web Services (AWS), which employs a robust security program with multiple certifications.
Data Hosting Security — All of our data is hosted on AWS databases located in the United States.
Encryption at Rest — All databases are encrypted at rest.
Encryption in Transit — Our applications encrypt in transit with TLS/SSL only.
Vulnerability Scanning — We perform vulnerability scanning and actively monitor for threats.
Logging and Monitoring — We actively monitor and log various cloud services.
Business Continuity and Disaster Recovery — We use our data hosting provider’s backup services to reduce the risk of data loss, and utilize monitoring services to alert the team in the event of any failures affecting users.
Incident Response — We have a process for handling information security events, including escalation procedures, rapid mitigation, and communication.

Access Security

Permissions and Authentication — Access to cloud infrastructure and other sensitive tools is limited to authorized employees who require it for their role. Where available, we use Single Sign-on (SSO), 2-factor authentication (2FA), and strong password policies.
Least Privilege Access Control — We follow the principle of least privilege with respect to identity and access management.
Quarterly Access Reviews — We perform quarterly access reviews of all team members with access to sensitive systems.
Password Requirements — All team members adhere to a minimum set of password requirements and complexity for access.

Vendor and Risk Management

Annual Risk Assessments — We undergo at least annual risk assessments to identify potential threats, including considerations for fraud.
Vendor Risk Management — Vendor risk is determined and appropriate vendor reviews are performed prior to authorizing a new vendor.

Contact Us

If you have any questions, comments, or concerns, or if you wish to report a potential security issue, please contact security@boodle.ai.