> How Contals protects your data: EU data residency on Cloudflare, private boards by default, server-checked permissions for every change, export and deletion… Source: https://contals.com/en/security/ Language: en # Your data is safe – and stays yours. Contals stores boards, the database and backups in Cloudflare’s EU jurisdiction, keeps boards private by default and checks every change on the server. [Start free](https://app.contals.com/login?mode=signup) [Data protection kit for DPOs](https://contals.com/en/data-protection/) Free for small teams. Volunteers and guests are always free. No credit card. ![The audit log of an organization: who changed roles, board access and settings, and when, with filters by person, type and date.](https://contals.com/_astro/audit-en-light.6t8BweJt_Z1twyvY.jpg) ![The audit log of an organization: who changed roles, board access and settings, and when, with filters by person, type and date.](https://contals.com/_astro/audit-en-light.6t8BweJt_Z1twyvY.jpg) ## Your data stays in the EU Board data, the database and backups are stored in Cloudflare’s EU jurisdiction – a US company, which we say openly. - EU jurisdiction - A US provider, disclosed - Data minimization In detail EU jurisdiction Board data (Durable Objects), the databases (D1), queues and backups are created in Cloudflare’s EU jurisdiction. A second copy of the backups lies at DigitalOcean in Frankfurt (Germany), encrypted by us before it leaves. A US provider, disclosed Cloudflare is a US company. We therefore say “EU data residency”, not “sovereign”, and name Cloudflare and DigitalOcean as subprocessors. Data minimization Changes to boards carry IDs, not names or e-mail addresses; profiles live separately. Contals stores no IP addresses: limits per address are counted at Cloudflare’s edge. ## Every change is checked New boards are private, and the server checks every change against the person’s role. - Private by default - Every change checked - Free roles have ceilings - Access removed means gone In detail Private by default New boards are visible only to the people added to them. Every change checked The server checks each change against the person’s board role (viewer, contributor, editor, admin) before it is saved. Free roles have ceilings Volunteers and guests can never manage a board, whatever they are granted. Access removed means gone When someone loses access, their open boards disconnect at once and the local copy is wiped. - ### Private boards stay private Owners and admins manage private boards without seeing their content – opening one is logged and shown to its members. [Docs – Private boards stay private](https://contals.com/docs/en/settings/workspace/#boards) Video: in the workspace’s settings, a member becomes an admin – workspace roles count for every board. Roles for everyone ## Signing in, safely Confirmed e-mail addresses, two-factor sign-in, passkeys and single sign-on. - Confirmed e-mail - Two-factor sign-in and passkeys - Google, Microsoft and single sign-on - Devices In detail Confirmed e-mail Every account confirms its e-mail address before anything is created. Volunteers can sign in with a one-time link instead of a password. Two-factor sign-in and passkeys A code from an authenticator app – with single-use recovery codes – or a passkey on your phone or laptop. Turning it on or off and adding or removing a passkey need a recent sign-in and are e-mailed to you. Google, Microsoft and single sign-on Sign in with Google, Microsoft and other providers – only with an address the provider has confirmed. Single sign-on (SAML 2.0, OpenID Connect) per organization on Team and Business, optionally required for your domains. Devices See all signed-in devices and sign out the others with one click; on a shared computer, Contals keeps no board copies in the browser. ## Control for organizations Owners require two-factor sign-in, see the audit log and protect sensitive boards as confidential. - Required two-factor sign-in - Audit log - Confidential boards - Retention rules In detail Required two-factor sign-in Owners can require two-factor sign-in of everyone who works in the organization. An owner can reset it for someone who works only in this organization and lost their phone and recovery codes – recorded in the audit log. Audit log Owners and admins see who changed roles, board access, sign-in settings, billing and settings, and who opened a confidential board – filtered by person, type and date, and as a CSV download, on every plan. Confidential boards For pastoral care or personnel matters: no titles in links, e-mails or push notifications, nothing to AI, the API or chat, and every opening is logged. Retention rules Board admins let done cards be archived or deleted automatically a chosen number of days after completion; each run shows in the board’s activity. - Video: the board’s activity is open while a colleague moves a card; his line appears at the top. ### Activity Every change is on record – in the activity of a card, of a board and of all your boards. [Docs – Activity](https://contals.com/docs/en/boards/basics/#activity) Video: a board is made confidential in its settings – from then on its titles stay out of links, e-mails and notifications. A confidential board ## AI on your terms AI only with your own provider and only once you switch it on – keys encrypted, tokens limited. - Your AI, your rules - What is kept - Encrypted secrets - Scoped API tokens In detail Your AI, your rules AI works only with your organization’s own provider and key, and only after an owner or admin switches it on. Comments and names are not sent by default, e-mail addresses never. What is kept The AI usage log counts tokens per day – no prompts, no answers. Assistant conversations stay in the person’s own storage for 30 days and can be deleted at any time. Encrypted secrets API keys of AI providers, single sign-on secrets and chat webhook addresses are encrypted (AES-256-GCM) and only ever shown masked. Scoped API tokens Personal API tokens never exceed the person’s rights, can be limited to one workspace, expire and are stored only as hashes. - ### Set up by an AI agent An AI agent signs a person up and sets up workspaces, boards and invitations – after the person confirms and approves its access. [Docs – Set up by an AI agent](https://contals.com/docs/en/ai/agents/) ## Your data, your decision Export any time, delete with a click – and what is deleted stays deleted. - Export - Deleting an account or an organization - Deleted stays deleted - No ad trackers In detail Export Board and workspace exports on every plan, the whole organization on Team and Business – as JSON, including the activity of the last 13 months. Every export is logged. Deleting an account or an organization Self-service. Personal data is erased for good after a 30-day grace period; shared content stays with the team as “Deleted user”. An organization is read-only for 30 days, then deleted with all its boards. Billing records stay only as long as tax law requires. Deleted stays deleted Every deletion is recorded with IDs only and applied again after any restore. Boards keep 13 months of history; backups and nightly copies of boards are deleted after 35 days. No ad trackers No ads, no data sales, no tracking cookies. The website, the docs and the sign-in pages count visits with privacy-friendly, cookieless statistics (Fathom); signed-in pages load no statistics script, and Global Privacy Control or Do Not Track turns it off. - ### Files as ZIP Board admins download every file of a board as a ZIP, with a folder per card. [Docs – Files as ZIP](https://contals.com/docs/en/boards/attachments-and-text/#files-on-confidential-boards-exports-and-moves) ## Found a vulnerability? Please write to security@contals.com – the address is also in /.well-known/security.txt. We answer within two working days and do not take legal action against good-faith research. [Privacy policy – Found a vulnerability?](https://contals.com/en/privacy/) ## Data protection kit for DPOs The DPA with Swiss and EU addenda and an optional church-law addendum, technical and organizational measures, subprocessors, a records template, a guide for sensitive boards and an FAQ – version 1.0. [Data protection kit – Data protection kit for DPOs](https://contals.com/en/data-protection/) ## Questions and answers ### Where is Contals data stored? In Cloudflare’s EU jurisdiction: board data, database, queues and backups; a second, encrypted copy of the backups lies at DigitalOcean in Frankfurt (Germany). Cloudflare is a US company, which is disclosed in the privacy policy. ### Is Contals GDPR-compliant? Contals is designed for the GDPR and the Swiss revFADP: EU data residency, data minimization, export and deletion. The data processing agreement (part of our terms), the technical and organizational measures and the subprocessor list are published in the data protection kit. ### We are outside Europe. Does Contals work for us? Yes. Contals works the same everywhere and keeps your data in the EU. The terms, the privacy policy and the DPA apply everywhere; they are written for Swiss and EU law, and the specific rules of other countries – for example US state privacy laws – are not assessed separately. ### Does Contals support two-factor sign-in? Yes. Everyone can turn on two-factor sign-in on their profile – with an authenticator app and single-use recovery codes – and add passkeys. Organization owners can require two-factor sign-in of everyone who works in the organization; people who sign in through the organization’s single sign-on are covered by its identity provider. ### Can Contals staff read my boards? Not as a normal part of operations: there is no support tool for reading board content. Access for support would need your request for the specific case and is logged. Organization admins see no board content unless they are members. ### What happens when I delete my account? You leave all workspaces at once and are signed out everywhere. Your personal data is erased for good after 30 days; billing records are kept as long as tax law requires. ### What happens to our data when we stop using Contals? An owner deletes the organization in its settings. For 30 days it is read-only and everything can be exported; then the organization, its workspaces, boards and member lists are deleted. If you only cancel the paid plan, nothing is deleted: the organization continues on the free plan. Backups and nightly copies age out within 35 days; billing records stay as long as tax law requires. ### Does Contals use AI on my data? Only if your organization switches it on with its own AI provider and key. Your organization decides which data may be sent, and every change the assistant suggests waits for your confirmation. Contals does not train AI models on your data. ## Start with a private board. [Start free](https://app.contals.com/login?mode=signup) Free for small teams. Volunteers and guests are always free. No credit card.