Isolation between customers is enforced in the database. You define the roles, sign-in can take a second factor, core records keep an audit trail, and you can export everything whenever you want. Your data is hosted in Germany.
Isolation between customers is enforced in the database, not only in application code. A request that cannot tell which business it is for is refused, never widened to everything. A session that lands on the wrong customer's address is signed out, with no exception for our own staff.
328 individual permissions across 53 modules. Five built-in roles, and you can create your own: a custom role works everywhere a built-in one does. Each role carries a data scope, own, team or all, separate from its permissions.
Two-factor sign-in with an authenticator app and 10 recovery codes. Re-enrolling needs the current code, so a hijacked session cannot swap the authenticator. Sign-in limits by country, IP range and working hours, set to off, warn or block.
Every sign-in attempt is logged, with brute-force detection. A field-level audit trail on core records shows who changed which field, and when. It is append-only. Stored credentials are encrypted at rest.
Deactivate a leaver and bring them back later, or replace their name and email with a placeholder for good while their past work stays attributed. You set where their open work goes.
Retention policies on 10 record types, enforced every night. Legal holds stop any rule deleting a record, and a queue handles data-subject requests.
Export your whole account whenever you want, with credentials redacted.
The customer portal uses a magic link, so your customers see their invoices, orders, tickets and help articles without another password to remember.
We do not hold SOC 2, ISO 27001 or HIPAA certification, and there is no single sign-on today. Your data is hosted in one region, Germany, with no choice of region. What we can show you is on this page. A data processing agreement is available on request. Retention rules, legal holds and the data-subject request queue are there to help you meet your obligations under Privacy Act.
The services that run BoldReach. Updated when changed.
Postgres + Auth + Storage
Subscription + invoice payments
Transactional + marketing
Durable background jobs
App + edge cache
Application error tracking
On our keys, unless you bring your own
Voice note transcription
We would like to count which pages people read, using Google Analytics. It tells us nothing about who you are, and the site works exactly the same if you say no.What we collect