A security firm's portal should survive its own audit.
Vulnerability reports and the files you share with us are some of the most sensitive data you have. Here is exactly how the client portal protects them — and what it cannot protect against.
Your keys are born in your browser
When you create your account, your browser generates an RSA-4096 key pair using the WebCrypto API. The private key is encrypted with a key derived from your password (PBKDF2-SHA-256, 600,000 iterations) before it is stored. We never receive your password or your private key in the clear.
Files are encrypted before upload
Each file gets a fresh AES-256-GCM key. That key is then encrypted separately for every person authorised on your organisation — your colleagues and the Portolan Sec consultant — with their public keys. The server only stores ciphertext; even the file name is encrypted.
Automatic deletion
Uploaded files expire after 30 days by default and are then deleted from disk and database. Engagements are deleted at the end of their retention period, unused accounts after a warning. Access is removed as soon as someone leaves your organisation in the portal. See the privacy policy.
Password never leaves your device
Your browser derives two independent keys from your password: one proves your identity (and is stored only as an Argon2id hash), the other unlocks your private key and never leaves the browser. Two-factor authentication (TOTP) is available for every account.
Small, memory-safe stack
The API is written in Rust, uses PostgreSQL, and runs in minimal containers behind a TLS-terminating proxy. Pages are static files with a strict Content Security Policy; there is no third-party JavaScript, analytics or CDN.
Everything is logged
Logins, downloads, risk decisions and administrative actions are written to an audit log. Accounts are only created through single-use, expiring invitation links and must be validated before they can sign in.
Your findings, in your tools.
Everything in the portal is available through a JSON API: projects, findings, attack graphs, comments, risk decisions and PDF reports. Create personal API tokens (read-only or read-write, always expiring) on the API page of the portal, where the full documentation and a Python client for encrypted files are available.
# list findings of a project curl -H "Authorization: Bearer $PS_TOKEN" \ $PS_URL/api/projects/$ID/vulns # download the PDF report curl -H "Authorization: Bearer $PS_TOKEN" \ -o report.pdf \ $PS_URL/api/projects/$ID/report.pdf
What this does not protect against
- Finding details (titles, descriptions, scores and screenshots) are stored server-side so they can be searched, put in the PDF report and served through the API. They are protected by strict access control and encrypted transport (screenshots are also encrypted at rest), and deleted with the engagement, but they are not end-to-end encrypted like files.
- End-to-end encryption relies on the code the server delivers to your browser. Recipient keys are pinned on first use, and uploads are blocked if a colleague's key unexpectedly changes.
- If you forget your password, your private key cannot be recovered: Portolan Sec sends you an account reset link, you get a new key pair, and files are shared again with the new key.