Built for secure client file collection.

Security approach

PortalLess is designed around a narrow workflow: securely request files, receive uploads, and help the firm track what is missing. We avoid unnecessary client accounts and keep access scoped to the firm workspace.

Access controls

• Firm users sign in with passwordless email authentication.
• Client upload links use long random tokens and expire after a defined request window.
• Firms can optionally require a request PIN or one-time email code before a client uploads files.
• Incorrect email-code attempts are limited and temporarily locked after repeated failures.
• Firm data is separated by workspace with database row-level access controls.
• Uploaded file metadata is tied to the firm, client, request, and requested file item.

File protection

• New files enter a separate private quarantine bucket before firm delivery.
• The server verifies declared limits, file signatures, and a SHA-256 checksum, then sends the bytes to an approved malware scanner.
• Only a clean scanner result can be copied into the private final storage bucket or made available through firm download routes.
• Infected, unknown, timed-out, and scanner-error results fail closed and never become firm-downloadable documents.
• The current limit is 15 MB per file, five files per checklist item, and 50 MB across one submission.
• File names are sanitized before storage paths are created.

Retention and deletion

• A firm's configured retention window starts only when a request becomes closed, archived, or expired—not while a close is active.
• A daily maintenance job removes expired quarantine objects and due private documents in bounded batches.
• After storage deletion, sensitive filename, type, path, and routing metadata is redacted while a minimal audit tombstone records the deletion outcome.
• Failures are recorded for operator review and are not reported as successful deletions.

Operational practices

• Production credentials are restricted to protected server-side deployment environment variables.
• Operators use individual MFA-protected accounts; shared credentials are prohibited.
• The access, incident-response, deletion, and founder-unavailability procedures are documented and reviewed after material incidents or infrastructure changes.
• Controlled live pilots are limited to no more than five specifically allowlisted firm IDs and an expiration date. Malware handling, retention deletion, cross-firm negative tests, incident rehearsal, processor-term review, and pilot disclosure approval must pass first.
• Formal outside application-security review, attorney approval, and a separate backup operator remain required before general availability; PortalLess does not represent those milestones as complete for the controlled founding pilot.

Incident reporting

Report suspected unauthorized access, exposed links or credentials, cross-firm data, or malware concerns through the PortalLess incident-response page. Do not email sensitive documents as evidence.

Important note

This page describes PortalLess security practices and intended controls. It is not a certification, audit report, or legal opinion. Firms should evaluate PortalLess against their own professional and regulatory obligations before using it for sensitive client files.