Report a suspected security or privacy incident.

What to report

• A link, account, credential, or document that appears accessible to the wrong person or firm.
• A suspected stolen password, session, service credential, scanner token, or email-provider credential.
• A file believed to contain malware or a malware result that appears incorrect.
• A deletion or retention failure, unexpected document availability, or unexplained data change.
• Suspicious activity affecting PortalLess availability, integrity, or confidentiality.

How to report

Use the PortalLess support address shown in the application. Do not attach client financial documents; provide request IDs, times, and a description instead. A dedicated security mailbox is required before live-data activation.

What PortalLess does

• Records the report, detection time, affected systems, and available non-sensitive evidence.
• Contains the suspected access path, preserves relevant logs, and rotates or revokes exposed credentials.
• Determines the affected firms, records, time window, and required provider, counsel, insurer, customer, or regulatory coordination.
• Restores service only after the cause is addressed and the fix passes a negative-access or failure-mode test.
• Documents corrective actions and updates affected firms with confirmed facts on an appropriate cadence.

Responsible reporting

Do not access, download, change, or share more data than is necessary to describe a suspected issue. Do not disrupt the service, test against another firm's data, or publish sensitive details before PortalLess has had a reasonable opportunity to investigate and protect affected customers.

Scope of this page

This page describes the operating process, not a guarantee of a universal notification deadline. Contractual and legal notification duties depend on the facts, customers, and jurisdictions and are handled with qualified counsel.