Security
Last updated:
This page describes the controls protecting the hosted Portals AI service today. It lists only what is in place now, and we update it as that changes.
Controls
Encryption in transit
Every connection to the Service uses HTTPS. Our web front ends require TLS 1.2 or later and redirect plain HTTP to HTTPS, and the app and API send HTTP Strict Transport Security headers. Inside our network, the API reaches its cache over TLS, and the cache refuses unencrypted connections.
Encryption at rest
Our database, cache, file storage and logs are encrypted at rest. Credentials you grant to connectors are additionally encrypted by the application with AES-256-GCM before they are stored.
Hosting
The Service runs on Amazon Web Services in the United States (us-east-1). The database sits in a private network and is not reachable from the internet.
Backups
The production database is backed up automatically, with backups kept for 14 days, and is protected against accidental deletion.
Sign-in and single sign-on
Sign-in runs through Auth0, our identity provider. Enterprise customers can sign in through their own OpenID Connect identity provider.
Access control
Permissions are defined by roles and policies your organization controls, can be granted on individual objects, and are checked by the server on every request — hiding a button is never what protects your data.
Tenant isolation
Every request is scoped to your organization, and an object you can't read answers as if it doesn't exist. Queries the AI agent runs execute under a restricted database role that can reach only the views your access allows.
Audit log
Security-relevant activity in your organization, including sign-ins, changes to members, roles and access, and data deletions, is recorded in an audit log.
Rate limiting
Authenticated API requests are rate-limited per user.
Vulnerability management
Every release of our server image is scanned before it ships, and a release with a fixable critical or high-severity vulnerability is blocked. Released images are signed and carry a software bill of materials. The server runs as an unprivileged user.
Your data and AI
The content you connect to Portals AI is not used to train AI models, ours or anyone else's.
To answer a portal question, we send Anthropic, our AI model provider, the prompt and the context needed to answer it. Anthropic processes it under its commercial API terms, which exclude training on that data, and retains it under its standard API data-retention policy.
A custom webhook tool you register sends data only to the endpoint you host and control.
How long we keep your data, and how to have it deleted, is set out in our privacy policy.
Read the privacy policy.
Subprocessors
These third parties process customer data to run the Service. Each receives only the data needed for its function.
- Amazon Web Services (AWS): Cloud hosting and storage, in the United States (us-east-1) region where the Service runs.
- Auth0: Identity and authentication (sign-in and account identity).
- Stripe: Payment processing and subscription billing for paid plans.
- Google: OAuth-based connectors such as Google Sheets, within the access you grant. Used only for the sources you explicitly connect.
- Microsoft: OAuth-based connectors such as Microsoft Excel workbooks, within the access you grant. Used only for the sources you explicitly connect.
- Anthropic: The AI model provider behind portal answers; the prompts and context needed to answer your questions are sent to generate a response.
- Tavily: Web search. Used when a portal question uses the web-search tool.
- Mapbox: Geocoding addresses and coordinates. Used when a portal question uses a geocoding tool.
- CARTO: Basemap tiles behind portal maps, loaded by your browser; it receives your IP address and the map area on screen, never your records. Used when you view a map in a portal, unless the deployment replaces or turns off the basemap.
- OpenStreetMap Foundation: Basemap tiles for maps that use the OpenStreetMap style, loaded by your browser; it receives your IP address and the map area on screen, never your records. Used when a map uses the OpenStreetMap basemap, unless the deployment replaces or turns off the basemap.
This list covers the hosted service. A residency deployment, which runs in your own cloud account, uses the providers you configure for it, and its deployment review record lists them.
Reporting a vulnerability
If you believe you've found a security vulnerability in Portals AI, email security@portalsai.io with a description and the steps to reproduce it.
We acknowledge every report within 5 business days, keep you informed while we investigate, and fix confirmed vulnerabilities on a severity basis: critical issues within 7 days and high-severity issues within 30 days.
We will not pursue legal action against research done in good faith that avoids privacy violations, data destruction and disruption to the Service, does not access or modify other customers' data, and gives us reasonable time to fix an issue before it is disclosed.
We don't run a paid bug bounty program.
Report to: security@portalsai.io · Machine-readable contact: security.txt