# Security and data protection

- **Isolated per firm.** Every organisation’s data is separated by row-level security in the database. One firm cannot query another’s rows, by design rather than by convention.
- **Roles inside the firm.** Admins, portfolio managers and analysts see and do different things. Outside advisors can be invited with narrower access.
- **An attributed record.** Every research entry carries who logged it and when, its rationale and its attachments: the trail a compliance review asks for.
- **Sign-in you can manage.** Authentication runs through Clerk, with organisation membership controlled by your admins.
- **Analytics that mask inputs.** Product analytics record clicks and page views, and form inputs are masked in session replays.

## Questions

### Is AlphaBoard SOC 2 or ISO 27001 certified?

Not yet. We will publish certifications here when we have them, not before. Ask us for our current security questionnaire answers.

### Can our data be hosted in India?

India-region hosting is on the roadmap for firms that need it. Ask us for the current status before you sign.

### Does AlphaBoard help with SEBI record-keeping?

It keeps a timestamped, attributed record of research and decisions, which supports the record-keeping that the SEBI Research Analyst and PMS regulations require. Your compliance officer remains responsible for compliance.

### Which AI providers process our data?

AI features call third-party model providers, and documents in Institutional Memory are processed by Google’s Gemini models. We will share the current list and their data terms on request.