Security at Unboredly

    Built with security in every layer.

    How Unboredly is designed to protect employee and organizational data.

    Ask a security questionRead the Privacy Policy
    Defense in depthSix layers
    Six layers of protection around your data
    1. 01Identity & access
    2. 02Tenant isolation
    3. 03Data protection
    4. 04Secure infrastructure
    5. 05Continuous testing
    6. 06Secure development

    Our approach

    Security built in, not bolted on.

    We build on Google’s cloud for identity and data and Vercel for delivery, then add our own controls and automated testing.

    01

    Identity & access

    Authentication and role-based authorization run throughout the platform, with optional authenticator-app two-factor.

    Access is enforced at the data layer, not just hidden in the interface. Administrator, manager and employee capabilities are separate.

    • Authenticator-app two-factor
    • Role-based access control
    • Data-layer authorization
    • Email verification
    • Automatic sign-out after inactivity
    02

    Tenant isolation

    Unboredly is multi-tenant, and authorization controls keep each organization’s data separate. Every protected data operation is checked against authenticated identity, organization membership and role.

    • Organization-scoped access
    • Cross-organization regression tests
    • Privilege-boundary tests
    03

    Data protection

    Identity, application data and storage run on Google cloud services, which encrypt customer content at rest (AES-256) and protect data in transit. Every page and request is served over HTTPS (TLS).

    • Encrypted at rest (AES-256)
    • HTTPS / TLS in transit
    • Google cloud security infrastructure
    04

    Secure infrastructure

    The application is delivered over HTTPS on Vercel, which encrypts data at rest with AES-256 and uses TLS for data in transit.

    • HTTPS delivery
    • Encrypted at rest and in transit
    05

    Continuous testing

    Our public application is scanned with OWASP ZAP, an automated dynamic security test, every week and on every code change, for common web weaknesses and configuration issues.

    • OWASP ZAP security scanning
    • Weekly and on every code change
    • Web configuration checks
    06

    Secure development

    Every change runs automated build, authorization and end-to-end tests. Security-sensitive features have dedicated regression tests, so fixed weaknesses stay fixed.

    • Security regression tests
    • Authorization boundary tests
    • End-to-end application tests
    • Automated CI/CD checks

    Also built in

    Protected file handling

    File access follows the same identity, organization and authorization rules, and upload restrictions are covered by security regression tests.

    Security event visibility

    Unboredly records security-relevant events for supported workflows, such as turning two-factor authentication on or off and removing an employee.

    Certifications

    Clear about what’s certified.

    Google Cloud and Vercel hold independent certifications for their platforms, including SOC 2 Type II and ISO/IEC 27001. Those cover their infrastructure, not Unboredly.

    Unboredly has not yet completed its own audit. We plan to pursue formal certification based on what our customers need, and will say so here when we have it.

    Smart features

    Only what the feature needs.

    Some features, such as drafting onboarding plans and summaries, are processed by Anthropic and OpenAI. We send them only what the feature needs, only to deliver it. By default, neither provider trains its models on data sent through its API.

    Your data

    Your organization owns its data.

    Unboredly processes your data to provide the service. We don’t claim ownership of your content, onboarding materials or internal information.

    Always improving

    Security is an ongoing process.

    privacy@unboredly.comPrivacy Policy