How your records are protected

What protects your records today, and what is not done yet. If you have found a weakness, write to support@portfoliya.com; a person reads every message.

Signing in

Passwords are hashed with argon2id and are never recoverable, not even by us. They must be at least twelve characters and not one of the passwords people use most.
Two-step verification with an authenticator app, with ten single-use recovery codes. It is required to invite somebody to your records or grant them access, and to accept an invitation to somebody else’s or ask for access to them.
Repeated wrong passwords slow down further tries on that account, without ever locking it for good. A sign-in from a device we have not seen before is emailed to you.
Sign-ins end on their own when left unused. Your details lists every device signed in, and signs them all out at once.

In transit and at rest

Every connection is encrypted with TLS, and browsers are told to use nothing else.
The database is encrypted at rest by its provider, and our servers reach it only over an encrypted connection.
Two-step verification secrets are separately encrypted by the application, with a key kept outside the database.
Each nightly backup is encrypted before it is stored.
A deleted account can be reopened for thirty days. After that its records are removed, and a sealed copy, encrypted with a key kept outside the database, is kept for twelve months and then destroyed.

Who can see your records

Only people you choose. Somebody you invite, or who asks, sees nothing until you have seen who they are and said yes, at the level you pick. Nothing that grants access is ever sent by email: an invitation waits inside the account of the address you invited.
Access can end on a date, and you can end it at any time. Activity shows you when somebody opened your account and every change they made.
Nobody at Portfoliya can open your portfolio without your yes. To help with a support request we must ask you first; a yes gives view-only access for 24 hours, which you can end sooner.
Access to production data is restricted to named individuals, granted only where it is needed to run the service or to answer a support request you raised, and logged.

What we never ask for

Account numbers, the sign-in to your bank or brokerage, and government identification numbers. Figures are typed in or imported from a workbook, and the app refuses an account or identification number in any field you type in.
Your card. Payments are taken by Paddle, our merchant of record; your card number never reaches us.

On every page

No advertising, analytics, session recording or chat scripts. The only code from anyone but us is Cloudflare’s check that a visitor is a person, on the forms that ask for one, and Paddle’s checkout when you pay; the browser is told to refuse anything else. The companies that process data for us are listed under Who touches your data.

Not done yet

Your figures are not encrypted with a key only you hold. The server calculates with them, so somebody with authorized access to the database could read them.
No independent security review or penetration test has been done yet.

Telling us about a problem

Write to support@portfoliya.com with “Security” in the subject, and what you found and how to see it. Please do not look at, change or keep anybody else’s data, and give us a fair chance to fix it before telling others. We do not pay for reports, and there is no bug bounty. This address is also published in our security.txt file, the standard place security researchers look for it.