Protecting PORTIQA and its users.
Security controls are designed around a narrow API surface, delegated identity and payment providers, revocable bearer credentials, and minimal payload logging.
Current controls
- HTTPS is enforced on the canonical non-www origin, with HTTP Strict Transport Security.
- Authentication is delegated to Auth0; PORTIQA does not store account passwords.
- Payment card data is handled by Stripe; PORTIQA stores subscription references, not card numbers.
- API keys use 256 bits of random material, are shown once, stored as SHA-256 digests, and can be revoked by regenerating a key.
- State-changing dashboard actions use authenticated sessions and CSRF validation.
- API usage logs exclude request and response payload bodies.
- Search-provider credentials stored by the sitemap manager are encrypted at rest and redacted from logs.
Your part
Treat an API key like a password. Keep it in a secret manager or server-side environment variable; never embed it in browser code, mobile binaries, public repositories, screenshots, or support messages. Regenerate it immediately if exposure is suspected.
Report a vulnerability
Email security@portiqa.com with the affected URL, reproducible steps, impact, and any safe proof of concept. Do not access other users’ data, degrade availability, use social engineering, or retain data encountered during testing.
We ask for reasonable time to investigate and remediate before public disclosure. We do not claim a certification, external audit, or bug-bounty reward that has not been formally established.
Operational transparency
Current service information is published on the status page. Privacy and sub-processor details are in the Privacy Policy.