Security

Last updated October 12, 2026. Plain language, kept current as the service changes. Questions to [email protected].

In short: a dedicated server in a European data center behind Cloudflare; every connection encrypted, and the secrets the service holds encrypted at rest; nightly backups copied off-site and restore-tested every week; sign-in by emailed link, Google, with optional two-factor; your records exportable in full at any time; no third-party audit yet. The detail follows.

Where your data lives

PortSpace.io runs on a dedicated server in a European data center (Hetzner, Germany), behind Cloudflare. Each firm has its own portal at its own address; every record is stamped with the firm it belongs to and every query is scoped to that firm. A session is valid only on the portal that issued it, so a cookie from one portal cannot be replayed against another.

In transit and at rest

Every connection is HTTPS. The database and uploaded files sit on the server's own mirrored drives, which are not encrypted at the disk level; access to the server is limited to its operator, over keys. Secrets the service holds on your behalf — API keys, accounting-system tokens, payment-platform keys, two-factor seeds, signing secrets — are encrypted at rest with a key held outside the database, so a copy of the database alone does not expose them.

Who can get in

People sign in with a link or code sent to their work email, or with Google. The firm decides which email domains may enter and invites everyone else by name. Roles (viewer, restricted, employee, approver, accountant, team manager, administrator, owner, and the firm's own) and a permissions grid decide what each person can see and do; clients and contractors see only the projects they are given. Anyone can switch on two-factor sign-in with an authenticator app, and each person sees their signed-in devices and can sign any of them out; an administrator can shut anyone out of the portal at once. Vendors and clients act through single-purpose links that open one record and nothing else.

Money

PortSpace.io never holds client money. Online payments run through the firm's own payment platform; the service only creates the payment link and records the result. Financial figures on invoices and orders are snapshots that do not change when a specification is edited later, and every change to them is logged with who and when.

Backups and recovery

Every portal is backed up nightly: the whole database and the uploads (a library imported from another system is copied off-site file by file as well), kept off-site on Cloudflare R2 night by night, with the latest night also on the server. The nightly copy goes to Cloudflare R2 object storage, a separate provider from the servers, so a fault at one does not take both. Restores are rehearsed every week on a scratch database and the result is shown on the status page. Recovery target: if the service is lost, every portal back within four hours from the fault being reported, with data as of the last nightly backup — up to one day of changes. A firm can take a complete copy of its records (Excel or JSON, with every file) from Settings at any time.

Audit and retention

Every page viewed and every change made is logged per portal with the person, the time and the record. The firm chooses how long to keep the log (30 to 365 days) and can export it. To close a portal, the firm writes to us: its data is kept thirty days for export or a change of mind, then deleted from the service; the nightly off-site backups that still hold it are used only to recover the service after a fault, and go as the backup history is trimmed. A person can ask to be removed from a portal from their profile; the firm sees the request and can anonymize them.

Third parties we use

• Hetzner (Germany) — servers and storage. Cloudflare — DNS, TLS, edge protection, and the off-site backup store (R2).
• Resend — outgoing email (sign-in links, notifications, documents you send). An inbound-email provider, when the firm switches on project addresses.
• Stripe — billing of firms by PortSpace.io; and, when the firm connects its own account, client payments on the firm's platform.
• Our AI providers — Ask the project AI, receipt reading, meeting summaries, product-page reading, reading a client's brief, drafting concepts, and looking products up on the web, only where the firm has switched them on; content is sent for that request and not used to train models. A firm may instead use its own AI key (Settings → Integrations → AI), in which case its material goes straight to its own AI account and never through ours.
• Intuit (QuickBooks Online), Xero — only when the firm connects its own accounts.
• Slack, Microsoft Teams — only when the firm or a person connects a channel or workspace; alert text and a link go there, nothing else.
• Google, Microsoft — sign-in only, where the firm allows it; they see that you signed in, not what you do here.

Each company, what it receives and where, is on the full list of sub-processors.

How the software is built and run

Deploys are rolling, with no downtime, from the master branch. An end-to-end suite exercises the live service — every main page, then a throwaway project taken through specifications, a proposal, an order, an invoice and the reports — and confirmed problems are fixed as a priority. Dependencies are pinned and updated deliberately. The service is monitored around the clock and the status page shows the live checks. We have not yet completed a third-party audit (SOC 2 or ISO 27001); we will say so here when we have.

Reporting a problem

If you believe you have found a security issue, email [email protected] with the details. We acknowledge within one business day, fix confirmed issues as a priority, and will not take action against good-faith research that respects other firms' data.

Data processing agreement · Sub-processors · Status · Terms · Privacy