Enterprise-grade data Security

Portrait Research protects customer data through independently examined controls, encrypted infrastructure, strict access boundaries, and continuous monitoring.

Book a demo

Your data’s security is our commitment. Portrait Research undergoes an annual SOC 2 Type 2 examination and annual third-party penetration testing.

Learn more

Your data, encrypted

Your data is encrypted while stored in Portrait and when transmitted.

Separate access for each firm

Organization-level access controls protect your firm’s private research.

Built-in platform protection

Security safeguards extend to the software and infrastructure that handle your firm’s research.

Independently audited

An independent CPA firm examines Portrait’s security controls annually under SOC 2 Type 2.

Tested by security specialists

Independent specialists conduct annual penetration tests to identify vulnerabilities in Portrait.

Review security with us

Discuss your firm’s security requirements directly with the Portrait team.

The questions security teams ask first

What does Portrait Research’s SOC 2 report cover?

Portrait Research’s SOC 2 Type 2 report covers the Security category. The auditor assessed the design and operating effectiveness of the in-scope controls over the report period. Request the current report.

How is customer data encrypted?

Portrait Research requires TLS for data in transit. Data stores, uploaded documents, service volumes, secrets, and sensitive logs are encrypted at rest using AWS KMS-managed encryption.

How is customer access separated?

Auth0 identity tenants and AWS accounts are separated by environment. Portrait Research then enforces organization-scoped application checks, rejecting requests outside a user’s organization boundary.

How is programmatic access controlled?

Permissions and entitlements are checked alongside identity on requests. This keeps actions attributable to a user and applies the same organization boundary to programmatic workflows.

How often does Portrait Research conduct penetration tests?

Portrait Research commissions an independent penetration test of its production environment and customer application annually, with additional testing after material architecture changes when appropriate.

How does Portrait Research monitor security findings?

Portrait Research uses AWS Security Hub to aggregate findings from services including GuardDuty, Inspector, and Macie. Critical and high-severity findings enter the on-call remediation workflow.

How does Portrait Research address privacy rights and international transfers?

Portrait Research’s Privacy Policy describes California privacy rights and the safeguards used for international transfers, including Standard Contractual Clauses where applicable.