Your data is yours
You serve vulnerable people, and their information deserves care. Here's how Boswell protects the data you trust us with.
You own your data
Your client data belongs to you, always. Export it anytime as CSV, which opens in Excel, and take it with you if you ever leave.
We never sell your data
We do not sell or share your client data with third parties. Ever.
Collect only what you need
Only a name is required. Phone, email, address and birth date are optional, and you can turn off the built-in client categories your programs don’t need, so you collect less.
You control access
Decide who on your team can see and edit client records.
How we protect your data
- Hosting & infrastructure
- Boswell runs on Fly.io in US East (Newark, NJ), so your data stays on US infrastructure.
- Encryption
- Your data is encrypted at rest, and traffic is protected in transit with TLS.
- Backups & recovery
- Every database is continuously replicated to encrypted, off-site backup storage (Backblaze B2, in the US) and snapshotted daily, with 30-day retention. Your data is durable and recoverable.
- Access controls
- Access requires authentication, with role-based access to client data. Every code change runs automated security checks: Brakeman for the app, Dependabot and bundler-audit for dependencies. Audit logging and MFA are on the way.
Certifications
Boswell is not itself SOC 2 or HIPAA certified. We build on infrastructure that is independently audited: the application and database run on Fly.io (SOC 2 Type II, with a HIPAA Business Associate Agreement available), and encrypted backups are stored on Backblaze B2 (SOC 2 Type II, BAA available on request). Transactional email is sent through Resend (SOC 2 Type II).
HIPAA
Boswell is built for community and social-services programs: intake, service tracking, and reporting. Most deployments track services and supplies distributed rather than treatment records, which keeps them clear of 42 CFR Part 2 for the common case.
Boswell does not sign Business Associate Agreements by default. For a covered-entity deployment, a BAA can be put in place for the compute and storage layer (Fly.io and Backblaze B2 both offer one). If your deployment involves protected health information, contact us and we'll work through your requirements.
Read the details in our Privacy Policy and Data Processing Agreement.