Security & privacy
You do not have to trust us.
Most portals ask for your database credentials. We work without them — which means we cannot reach your existing data even if something goes wrong on our side.
Your database stays closed — even if we are the ones hit
The usual route is to hand a platform your database credentials. Your security then hangs on ours. We do it the other way round.
- The connect agent runs inside your network and opens the connection outbound. You open no port and add no firewall rule.
- Only you know the database credentials. They live with the agent, point to environment variables there, and never exist on our side.
- We do not send SQL, we send the name of a query. If it is not on your allow list, nothing happens — the agent replies “not approved”.
- Values are bound, never pasted into the query text. Input from the portal therefore cannot change the query.
- Only whoever holds the admin key can change the allow list. It is created when the agent starts, appears in your container logs, changes on every restart — and is unknown to us.
Sign-in through your own directory
Who has access is decided in your system, not in ours.
- Company-account sign-in per tenant: Entra ID, Okta, Keycloak or any other service that speaks OIDC or SAML. You enter your own provider.
- The domain must be proven before sign-ins run through it — via a TXT record in DNS. Without that proof nobody can claim someone else’s domain.
- On request, passwords are switched off for your tenant: sign-in then only works through your directory. Lock an account there and it is locked here.
- A second factor for staff, mandatory for the whole tenant if you want. Plus an IP allow list and sign-out on inactivity.
Servers in Germany, operations without open doors
Where the data that does sit with us lives — and how we run it.
- Application and database run on servers in Germany; files and backups sit in the Nuremberg data centre.
- Database and cache are unreachable from the internet. Even we only reach them over a private network, never a public address.
- Traffic between servers is encrypted over WireGuard.
- Backups live with a different provider than the application and are stored write-protected — not even we can change them after the fact.
- Credentials for connected systems are stored encrypted with AES-256-GCM.
No quiet bystanders
A portal that hands data to third parties on the side is a privacy problem nobody sees — until somebody looks.
- No Google Fonts. Typefaces ship with the portal; no request goes to a foreign server.
- No analytics at Google. We measure with Plausible on our own infrastructure, without cookies and without profiles.
- You upload your own corporate typeface — it ships the same way.
Separated, logged, tiered
What applies inside the platform.
- Every tenant is its own data space. The separation reaches down to the sign-in records — the same email address can exist at two providers without anything touching.
- Roles decide who may do what: owner, admin, designer, adviser. The check happens on the server, not only in the interface.
- Changes to clients, portals, data and access land in the audit log — with timestamp, acting person and the details of the change.
- Signatures carry their own evidence chain: each step references the previous one, and any later change breaks the chain visibly. Including for us.
What we do not have (yet)
Portenia is a young product. We hold no ISO 27001 or SOC 2 certification — the measures above are built and verifiable, but not attested by an external body. Equally honest: we cannot issue the qualified electronic signature ourselves; that requires an accredited trust service provider. If your procurement requires a certificate, say so early and we will discuss it rather than stall you.
Which service providers we use and what for is listed in the privacy policy. We answer questions about it directly.
Your IT has questions? Good.
We walk through the architecture with whoever runs your IT — agent, allow list, operations. Better beforehand than mid-project.