Security & Trust

PortLens (ABN 59 498 934 467) is a portfolio-risk copilot for ASX-listed and global securities. It helps investors understand the risk exposures in a portfolio they enter — it does not execute trades, hold client money, or access brokerage accounts. Below we describe the controls that protect customer information, organised by the SOC 2 Trust Services Criteria.

This overview covers the PortLens web application, its API and supporting cloud infrastructure, against three criteria commonly requested of fintech vendors:

• Security — systems are protected against unauthorised access.
• Availability — the service is reliable and available as intended.
• Confidentiality — customer information is protected and access-restricted.

• Authentication. Token-based auth (signed JWTs) with automatic session expiry.
• Password storage. Passwords hashed with bcrypt and unique per-password salts — never stored in plaintext.
• Encryption in transit. All traffic served over HTTPS/TLS, terminated at a hardened edge (Cloudflare).
• Secrets management. Keys, database credentials and signing secrets live only in server-side configuration — never in the browser or source.
• Input validation. Every API request is type-validated (Pydantic) before processing.
• Access control. Least-privilege entitlement layer; administrative functions segregated from standard access.
• Payment data. Card payments are handled entirely by Stripe (PCI-DSS Level 1); PortLens never stores card numbers.

• Managed infrastructure. Containerised cloud infrastructure behind an edge/CDN network (Cloudflare) with DDoS protection.
• Managed database. Data stored in a managed MongoDB service with provider redundancy and durability.
• Monitoring. Application events are logged; operational metrics are surfaced on an internal dashboard.
• Graceful degradation. External providers (market data, FX, email, AI) are wrapped with timeouts and fallbacks.

• Data minimisation. We collect only account email & name, a hashed password, and the holdings you choose to enter — no bank logins, card numbers or government IDs.
• Segregation. Each user's portfolio and options data is scoped to their account.
• No sale of data. PortLens does not sell customer data; analytics are consent-gated and aggregated.

We process account data (email, name, bcrypt-hashed password), portfolio data (tickers, quantities, cost bases, option positions) and consent-gated aggregated analytics. Billing identifiers are held by Stripe. You may request access, correction or deletion of your data. Full detail is in our Privacy Policy and Cookie Policy.

PortLens relies on these reputable providers, each bound by its own security commitments:

• Cloudflare — edge network, TLS, DDoS protection.
• MongoDB (managed) — primary database; account & portfolio data.
• Stripe — payments & billing (PCI-DSS L1); no card numbers stored by PortLens.
• Resend — transactional & nurture email.
• Emergent — application hosting & managed AI gateway.
• Anthropic / OpenAI — AI text generation (via Emergent).
• ElevenLabs / OpenAI — text-to-speech for audio briefs.
• Yahoo Finance — market prices & FX (public data only).
• Microsoft Clarity — consent-gated product analytics.

Planned enhancements, not yet in place, include: multi-factor authentication; rate limiting & brute-force protection; a documented policy suite; independent penetration testing and scheduled vulnerability scanning; backup-restoration & disaster-recovery testing; and engagement of a licensed CPA firm for an independent SOC 2 Type II examination.

We're happy to answer security questionnaires and share detail under a mutual NDA. For security matters or vendor due-diligence, email security@portlens.com.au. See also our ISO 27001 alignment.