Security

The application itself

Tenant isolation, enforced and tested: every firm's portal is a separate tenant, and every read and write is scoped server-side to the caller's tenant and role. We keep an automated test suite that attempts cross-tenant reads, client-role writes, and unauthenticated access — all of it fails closed, and we re-run it as the product changes.

No shared or generated passwords: nobody at your firm — and nobody at ours — ever sees or sets a client's password. Access is by single-use, expiring invite link, and every user chooses their own credentials. Password recovery works the same way.

Encrypted in transit: all traffic between browsers, the application, and the backend runs over TLS. Uploaded files are stored encrypted at rest (AES-256).

E-signature audit trail: each signature stores the signer's typed legal name, their authenticated account email, the exact date and time, and a snapshot of the consent language they agreed to.

Role-based access: staff and client roles are enforced by the server on every endpoint — the interface is a convenience, never the security boundary.

The infrastructure it runs on

Hosting and file storage: Vercel — independently SOC 2 Type II attested (Security, Confidentiality, Availability) and ISO 27001:2022 certified. File storage is built on Amazon S3 with AES-256 encryption at rest.

Transactional email (invites, resets, alerts): Resend — SOC 2 Type II attested, with regular third-party audits.

Backend and database: Xano, hosted in the United States, with all access over TLS and application-level tenant scoping as described above.

Your data is yours

Export anytime: your full client book exports to CSV on demand — no request tickets, no waiting, no exit fees.

Ownership at month 24: on the standard plan, the entire portal — code, data, and brand — transfers to you outright. Until then, the data is still yours; we're just running the software.

Analytics only with consent: our marketing site loads no tracking of any kind unless a visitor explicitly accepts, we honor the Global Privacy Control browser signal, and every consent decision is logged with a verifiable record ID. The portals themselves contain no third-party analytics at all.

Honest answers to the audit question

Is the application itself SOC 2 attested? Not yet. A SOC 2 Type II report on our own controls is on the roadmap and will be commissioned when client scale justifies the audit. We'd rather tell you that plainly than imply otherwise — if your firm requires the report as a condition of purchase, tell us; demand is exactly what moves it up the roadmap.

Found a vulnerability? Email eric@quidortmarketing.com — reports are read same-day, and good-faith research is welcome.