Security

Infrastructure

All PortalPilot infrastructure runs in the EU. We self-host our database and analytics on our own servers, not through third-party SaaS.

Encryption

• OAuth tokens: Encrypted with AES-256-GCM using PBKDF2 key derivation (100,000 iterations) and a random 16-byte salt per operation. Tokens are never stored in plaintext.
• In transit: All connections use TLS 1.2 or higher.
• Backups: Database backups (including authentication data) are GPG-encrypted with AES-256 and stored off-server.
• Client-side: No sensitive data is stored in the browser. Authentication tokens are handled by Supabase's secure session management.

Authentication and access control

• HubSpot OAuth 2.0: We never see or store your HubSpot password. Access is granted via OAuth consent and can be revoked at any time from your HubSpot settings.
• Application auth: Supabase JWT-based authentication with secure session handling.
• Row-Level Security: Every database table is protected by RLS policies. Users can only access data belonging to their own portals.
• Edge function auth: Every API call validates the JWT, verifies the user identity, and confirms portal ownership before processing.

OAuth scopes & justifications

PortalPilot requests the minimum HubSpot OAuth scopes required for diagnostics and customer-approved remediation. Each scope is justified below.

Optional scopes are requested only when the corresponding HubSpot tier or feature is detected. Drift between this table and the canonical OAuth request list is enforced by an automated test.

Enterprise security hardening

As of March 2026, PortalPilot implements a comprehensive, multi-layer security hardening programme:

• Portal ownership verification: Every API endpoint verifies that the requesting user owns or is a team member of the portal before processing. Cross-tenant data access is impossible.
• AI prompt sanitisation: User-controlled data is sanitised before being sent to AI models, preventing prompt injection attacks.
• Data retention enforcement: Configurable per-portal retention policies with automated enforcement. Analysis history, pipeline data, and form analytics are automatically pruned based on your settings.
• Account deletion completeness: Deleting your account revokes all HubSpot OAuth grants, removes security audit records, and cleans up all associated data across 40+ database tables.
• Encrypted backups: Database backups (including auth data) are GPG-encrypted with AES-256 and stored off-server for disaster recovery.
• Supply chain protection: Build-time dependencies are pinned to exact versions. CI enforces authentication checks on all API endpoints.

Access controls

• Minimal team: PortalPilot is founder-operated. No third-party contractors or external personnel have access to production systems or customer data.
• Least privilege: All system access follows the principle of least privilege. Database access is restricted to scoped service roles.
• MFA required: Multi-factor authentication is enforced for all infrastructure access.
• SSH key authentication: Server access requires passphrase-protected SSH keys. No password-based authentication is permitted.
• Application isolation: Edge functions run in sandboxed Deno workers with no shared state between requests or tenants.

Incident response

We maintain a documented incident response process:

• Detection: Automated monitoring of authentication events, API access patterns, and system health. Comprehensive audit logging on all data access operations.
• Assessment: Incidents are classified by severity and impact. Both confirmed and assumed personal-data breaches are escalated immediately; the GDPR Article 33 notification path is entered when founder assessment determines the probability of compromise is more likely than not (greater than 50% threshold).
• Notification: In the event of a personal data breach, affected customers are notified within 72 hours as required by GDPR Article 33. The relevant supervisory authority is notified where required.
• Remediation: Root cause analysis, fix deployment, and post-incident review for every security event.

Contact: security@portalpilot.io

Business continuity

• Automated backups: Daily database backups including all schemas and authentication data.
• Encrypted at rest: All backups are GPG-encrypted with AES-256 and stored off-server, separate from the primary infrastructure.
• Recovery: Tested restoration procedures. Container orchestration via Coolify enables rapid service recovery.
• Data durability: Primary data resides on Hetzner's enterprise-grade storage with hardware redundancy.

Logging and monitoring

• Audit logging: All write operations, authentication events, and data access actions are logged with timestamps, user identifiers, and action details.
• Retention: Audit logs are retained for 90 days.
• PII protection: Email addresses and other personal identifiers are masked in log output to prevent accidental PII exposure.
• Security monitoring: Authentication failures, rate limit violations, and anomalous API access patterns are monitored.

Responsible disclosure

We welcome reports from security researchers who discover vulnerabilities in our application, API, or infrastructure.

• Report to: security@portalpilot.io
• Acknowledgement: We will acknowledge receipt within 3 business days and provide an initial assessment within 10 business days.

Data handling

We access your HubSpot portal to analyse property configurations and compute health scores. Here is exactly what we access and store:

AI processing

AI features (property suggestions, descriptions, embeddings) are processed by Mistral AI in Paris, France.

• Only property metadata is sent (names, descriptions, types) — not individual record values
• Per Mistral AI's data processing terms, API data is not stored beyond the request and is not used for model training
• All processing stays within the EU

GDPR compliance

• Data controller: NordScope, a Finnish sole trader (toiminimi), Y-tunnus 3148476-5, owner-operator Peter Sterkenburg
• DPA: A Data Processing Agreement is available for all customers
• Data export: Full export available on request
• Right to erasure: Delete your account and all associated data at any time. HubSpot OAuth grants are automatically revoked and all security audit records are cleaned up
• Supervisory authority: Office of the Data Protection Ombudsman (Finland)

Standards & frameworks

Frameworks PortalPilot has measured itself against:

Self-attestation is PortalPilot's own structured assessment against a publicly-published cloud-compliance framework — not a monitoring-body-validated declaration. Submission to SCOPE Europe is on our compliance roadmap.

Security roadmap

• Q3 2026 — external penetration test (full application + infrastructure).
• Q3 2026 — Cyber Essentials Plus certification.
• Q3 2026 — review SOC 2 Type II vs ISAE 3000 readiness.
• Q1 2027 — EU Cloud CoC Level 1 verified declaration (Phase 2; commercial terms under review).

Quarters subject to enterprise demand and budget allocation.

Questions?

For security questions, vulnerability reports, or to request a security questionnaire, contact us at security@portalpilot.io.