Security & trust

Built to protect what you publish.

Your professional identity deserves serious protection. Here is exactly how Portfolio OS keeps your account, your data and your documents safe.

Your account

Passwords must be at least 10 characters and are checked against known data breaches before they are accepted. We never see or store your password — only a one-way hash.
Two-factor sign-in with an authenticator app, required for every administrator.
Sign-in cookies cannot be read by scripts on the page, and every session ends automatically after 30 days.
Repeated failed sign-ins are slowed down per account and per network.

Your data

All traffic is encrypted with HTTPS (HSTS enforced), including portfolios on custom domains.
Every account’s data is isolated in the database itself (row-level security on every table), so one account can never read another’s — even if application code had a bug.
Private files are stored privately and shared only through short-lived signed links.
Uploads are checked by their actual content, not their file name; executable and macro attachments are blocked in email.

Your documents

Issued letters and certificates cannot be edited — only revoked and reissued — and every version is fingerprinted with SHA-256.
Verification shows the live status (valid, revoked, expired or replaced) and the exact original PDF, straight from the source.
Signatures are recorded with explicit consent, the time and the exact text approved; signing links are single-purpose and stored only as secure hashes.

Protection from abuse

Accounts are created only through our servers, with bot detection and rate limits on sign-up, contact and request forms.
New accounts have limited email sending, and outgoing mail is authenticated with SPF, DKIM and DMARC so nobody can convincingly impersonate our domain.
A strict Content Security Policy, anti-framing and other browser security headers protect every page.

Privacy by default

Nothing is public until you publish it; contact details are hidden unless you switch them on.
No advertising, no third-party trackers, and we never sell personal data. IP addresses are only stored as salted hashes.
Export everything at any time. Deleting your account permanently removes your data and files after a 7-day grace period.

How we operate

Administrative actions are written to an append-only audit log.
Secrets are kept only in encrypted server environments, never in code; dependencies are audited for known vulnerabilities.
Database changes are tested automatically against isolation and permission rules before release.

Report a vulnerability

Found a security issue? Please tell us privately at support@portfolio-os.online with steps to reproduce. Do not access other people’s data, disrupt the service or run automated scans against it. We will acknowledge your report and keep you informed.

Machine-readable policy: /.well-known/security.txt

Can other users see my private data?

No. Isolation is enforced by the database for every request, not only by the website, so private entries, files, messages and drafts are visible only to you.

What happens if someone steals my password?

Turn on two-factor sign-in: a password alone is then not enough to enter your account. Passwords found in public breaches are rejected, and all sessions end after 30 days.

Can a verified document be faked or changed?

Issued documents cannot be edited. Anyone can scan the QR code or enter the ID to see the live status and download the original file to compare.

How do I report a security problem?

Email the address on this page or in /.well-known/security.txt. We investigate every report and appreciate responsible disclosure.

No online service can promise to be immune to every attack. We follow industry best practice, review our protections regularly and will notify affected users promptly if a breach ever occurs, as described in our privacy policy.

Explore more

Features Everything the platform can do.Templates Six designs for every profession.Portfolio directory Browse live professional portfolios.Pricing One plan, everything included.