Security & privacy
You do not have to trust us.
Most portals ask for your database credentials. We work without them — which means we cannot reach your existing data even if something goes wrong on our side.
Your database stays closed — even if we are the ones hit
The usual route is to hand a platform your database credentials. Your security then hangs on ours. We do it the other way round.
- The connect agent runs inside your network and opens the connection outbound. You open no port and add no firewall rule.
- The database credentials live with the agent — as an environment variable if you prefer. If you enter them in the admin area, we pass them through to the agent and do not store them.
- We do not send SQL, we send the name of a query. If it is not on your allow list, nothing happens — the agent replies “not approved”.
- Values are bound, never pasted into the query text. Input from the portal therefore cannot change the query.
- Only whoever holds the admin key can change the allow list. It is created when the agent starts, appears in your container logs, changes on every restart — and is unknown to us.
The door only opens from the inside.
Your database
Connect agent
Allow list
- client_contracts
- open_invoices
Credentials
only with the agent, as environment variables
Admin key
in your container logs, new on every restart
Firewall
↓→outbound
inbound: closed
Portenia cloud· sends a name only
client_contracts
result
export_all_data
“not approved”
Values are bound — input stays a value
Sign-in through your own directory
Who has access is decided in your system, not in ours.
- Your team signs in with the company account: you set up Microsoft Entra ID yourself in the admin area (OpenID Connect). Other providers on request. Company-account sign-in is for your staff — your clients sign in to the portal with their own account.
- The domain must be proven before sign-ins run through it — via a TXT record in DNS. Without that proof nobody can claim someone else’s domain.
- On request, passwords are switched off for your tenant: sign-in then only works through your directory. Lock an account there and it is locked here.
- A second factor (authenticator app) for staff — you can require it for everyone or for admins; anyone who has not set it up yet sees a persistent notice. Plus an IP allow list and sign-out on inactivity.
- Your clients can protect their portal account with a second factor too — authenticator app plus backup codes.
Password
via OpenID Connect · other providers on request
Locked there = locked here
Domain proof
proven- Type
- TXT
- Name
- example.com
- Value
- proof value from Portenia
Rules for staff
- Second factor, required per role
- IP allow list
- Sign-out on inactivity
Servers in Germany, operations without open doors
Where the data that does sit with us lives — and how we run it.
- Application and database run on servers in Germany; files and backups sit in the Nuremberg data centre.
- Database and cache are unreachable from the internet. Even we only reach them over a private network, never a public address.
- Traffic between servers is encrypted over WireGuard.
- Backups live with a different provider than the application and are stored write-protected — not even we can change them after the fact.
- Credentials for connected systems are stored encrypted with AES-256-GCM.
Internet
Application
Database
Cache
no public address
Files
Backups
write-protected — for us too
different provider than the application
No quiet bystanders
A portal that hands data to third parties on the side is a privacy problem nobody sees — until somebody looks.
- No Google Fonts. Typefaces ship with the portal; no request goes to a foreign server.
- No analytics at Google. We measure with Plausible on our own infrastructure, without cookies and without profiles.
- You upload your own corporate typeface — it ships the same way.
- clients.example.comPageown
- clients.example.comTypefaceown
- clients.example.comCorporate typeface (uploaded)own
Not used
- Google Fonts
- Analytics at Google
Instead
- Typefaces ship with the portal
- Plausible on our own infrastructure — no cookies, no profiles
Separated, logged, tiered
What applies inside the platform.
- Every tenant is its own data space. The separation reaches down to the sign-in records — the same email address can exist at two providers without anything touching.
- Roles decide who may do what: owner, admin, designer, adviser. The check happens on the server, not only in the interface.
- Changes to clients, portals, data and access land in the audit log — with timestamp, acting person and the details of the change.
- Signatures carry their own evidence chain: each step references the previous one, and any later change breaks the chain visibly. Including for us.
Tenant A
anna@example.com
Tenant B
anna@example.com
same address, two separate accounts
Roles
checked on the server- 09:14Portal “Client area” publishedA. Keller
- 10:02Access created for M. WeberJ. Brandt
- 11:37Record changed: phoneA. Keller
Evidence chain of a signature
1. Created
—
2. Opened
references the previous step
3. Signed
references the previous step
a later change breaks the chain visibly
Names and times: examples
What we do not have (yet)
Portenia is a young product. We hold no ISO 27001 or SOC 2 certification — the measures above are built and verifiable, but not attested by an external body. Equally honest: we cannot issue the qualified electronic signature ourselves; that requires an accredited trust service provider. If your procurement requires a certificate, say so early and we will discuss it rather than stall you.
Which service providers we use and what for is listed in the privacy policy. We answer questions about it directly.
Your IT has questions? Good.
We walk through the architecture with whoever runs your IT — agent, allow list, operations. Better beforehand than mid-project.