Security

The application itself

Tenant isolation, enforced and tested: every firm's portal is a separate tenant, and every read and write is scoped server-side to the caller's tenant and role. We keep an automated test suite that attempts cross-tenant reads, client-role writes, and unauthenticated access. All of it fails closed, and we re-run it as the product changes.

No shared or generated passwords on production accounts: nobody at your firm, and nobody at ours, ever sees or sets a client's password. Access is by single-use, expiring invite link, and every user chooses their own credentials. Password recovery works the same way. (Demo portals use disposable throwaway logins that are deleted at activation.)

Encrypted in transit, private at rest: all traffic between browsers, the application, and the backend runs over TLS with HSTS. Uploaded files live in a private store, encrypted at rest (AES-256), and are served only through expiring signed links minted after a per-document permission check. A forwarded or leaked link goes dead in minutes.

E-signature audit trail: each signature stores the signer's typed legal name, their authenticated account email, the exact date and time, and a snapshot of the consent language they agreed to.

Role-based access: staff and client roles are enforced by the server on every endpoint. The interface is a convenience, never the security boundary.

Two-step sign-in for staff: on live firm portals, every staff and owner login requires a 6-digit code sent to their email. A stolen password alone opens nothing. Clients can switch the same protection on from their account page.

Instant deprovisioning: remove a teammate and every session they hold dies that second, on every device. No waiting for a token to expire. Password changes and resets revoke old sessions the same way. Seasonal staff turnover is normal in accounting; lingering access is not.

Breach-screened passwords: every new password is checked against known breach corpora before it's accepted (privately. Only a hash fragment ever leaves the server).

Who's watching

A complete audit trail: every document view and download, every login and failed login, every role change, invite, and export is recorded. Who, what, when, from where. If a firm ever asks 'what did that former employee access?', the answer is one query, not a shrug.

Tamper-evident by design: the audit log is protected by a cryptographic hash chain whose running fingerprint is pushed off-platform daily. Editing history after the fact is detectable, and the full log is archived every day to separate storage under separate credentials.

Watched daily, alerted instantly: automated daily review of the security log, plus real-time alerts on account lockouts and bulk-download patterns. The 'former employee downloads the vault' shape triggers a push notification, not a quarterly discovery.

Backed up off-platform: client documents and the audit history are copied daily to an independent private store, and restore procedures are actually tested. Our last restore drill is dated and on file.

The infrastructure it runs on

Hosting and file storage: Vercel. Independently SOC 2 Type II attested (Security, Confidentiality, Availability) and ISO 27001 certified. File storage is built on Amazon S3 with AES-256 encryption at rest.

Transactional email (invites, resets, alerts): Resend. SOC 2 Type II attested, with regular third-party audits.

Backend and database: Xano. Independently SOC 2 & SOC 3 attested and ISO 27001-certified, hosted in the United States, with all access over TLS and application-level tenant scoping as described above.

In short: every layer this product runs on, hosting, file storage, email, backend, carries independent SOC 2 attestation.

Your data is yours

Export anytime: your full client book exports to CSV on demand. No request tickets, no waiting, no exit fees.

Ownership at month 24: on the standard plan, the entire portal, code, data, and brand, transfers to you outright. Until then, the data is still yours; we're just running the software.

Measurement, honestly: our marketing site uses measurement-only cookies (no ad personalization, no profiling) with a one-click opt-out, honors the Global Privacy Control browser signal as an automatic opt-out, and logs every consent decision with a verifiable record ID. The portals themselves contain no third-party analytics at all.

Honest answers to the audit question

Is the application itself SOC 2 attested? Not yet. A SOC 2 Type II report on our own controls is on the roadmap and will be commissioned when client scale justifies the audit. We'd rather tell you that plainly than imply otherwise. If your firm requires the report as a condition of purchase, tell us; demand is exactly what moves it up the roadmap.

What we can hand you today instead: a prefilled security questionnaire, our subprocessor list, and a running compliance register mapped to the FTC Safeguards Rule. Sent same-day on request, before you sign anything. We are insured, including dedicated data-breach coverage, and our incident commitment is written down: affected firms are notified within 72 hours of confirming their data was involved.

Found a vulnerability? Email eric@quidortmarketing.com. Reports are read same-day, and good-faith research is welcome.