Boswell

Trust

A thinking partner is only useful if you can be honest with it.

This page is maintained by Alyve to answer the questions executives actually ask about Boswell. It describes how the product works today. It is not an independent audit and not a certification.

Who runs this

Boswell is a product of Alyve, a leadership advisory practice. Alyve is responsible for how Boswell is built, hosted, and improved.

Administrative actions taken by Alyve staff, such as inviting or removing a member, are written to an audit log. No one at Alyve routinely reads your conversations.

What Boswell reads

When you write or speak to Boswell, the current conversation is sent to a large language model to produce the reply. Text sessions use Anthropic's Claude. Voice and transcription use OpenAI. These are business API calls, not public chatbots.

Boswell also reads short summaries from your prior closed sessions, the open threads and patterns he has recorded for you, and, if your organisation has uploaded a Team X-rays result, the aggregate patterns from that survey. He uses these as background so he can pick up threads and hold you to account.

What Boswell never does

· Alyve does not train any model on your conversations.

· He does not show your conversations to other members of your organisation, including other leaders on your team.

· He does not surface individual Team X-rays scores or names to you. He reads aggregate patterns only.

· He does not give medical, legal, or HR advice. If a conversation drifts there, he will say so and point you to the right professional.

Where your data lives

Conversations, session summaries, and account data are stored in a managed Postgres database hosted in the United States. Transport is TLS end to end.

Sub-processors we currently use: Supabase (database and auth), Anthropic (language model), OpenAI (voice and transcription), Resend (email delivery), and Cloudflare (edge hosting). Each is bound by its own data processing terms.

Retention and deletion

You can export a plain-text file of every session summary you've written, from Settings.

You can delete your account from Settings. That removes your account, every session, every message, every summary, every thread, and every profile note tied to it. There is no soft-delete and no shadow copy in the application database.

Team X-rays

Team X-rays is a psychological-safety survey your organisation may have run. If it has, its aggregate results are used as silent context so Boswell can hold the leader to account on the patterns their team reported. Boswell does not quote individual scores and does not name respondents.

Only super admins and the leader flagged as the Team X-rays customer can upload or delete a round. Other members of the organisation cannot see the responses.

Security posture

Authentication is passwordless (email magic link) or Google / Apple sign-in. Access to the Study is granted by an Alyve super admin. Every read and write goes through row-level security policies scoped to the owning account. Server-side keys never reach the browser.

We do not claim SOC 2, ISO 27001, or HIPAA compliance. If your organisation needs a specific certification before running a pilot, contact us and we'll tell you what we do and don't have.

Incidents and contact

If you spot a security issue or a privacy concern, email us and we'll treat it as urgent: hello@alyve.consulting.

We will notify affected users of a material data incident without unreasonable delay.