In Frankfurt (Germany), in the European Union, on an instance dedicated to your agency. It is not shared with other agencies.

Who at the agency can see my files and my pieces?

The people at your agency with access to their space, according to their role. Nobody from another client: each space is isolated.

Can the agency's other clients see my data?

No. Each client only sees their own space, and that separation is checked in the code with automated tests.

Is there any artificial intelligence reading my content?

No. There is no AI feature of any kind in the portal.

Can I download my files?

Yes, from the Library in their space, for as long as they have access. There is no automatic export of all the data in an account.

What if I forget my password or share it by mistake?

It's reset by email with a single-use link and, when that happens, every open session is closed. The agency owner can reset it too.

Will my clients get emails from PortaliaFlow?

No. Emails go out from your agency's sender, with your name, from a verified domain and in each person's language. PortaliaFlow doesn't appear.

Do you sign a data processing agreement?

We go through it on the call and, if needed, sign it outside the portal before we start. There is no agreement to accept inside the portal.

What happens to the data if I leave PortaliaFlow?

The instance is yours: your own server, database and files. What you get back and when it's switched off is put in writing before we start.

Security and data

Where your data lives, who sees it and what's still missing.

What a client (or their IT lead) will ask before they log in to the portal, with the answer as it is. No compliance badges: facts, and what we don't have, said out loud.

Dedicated instance in the EU
Encryption and daily backups
What's missing, in writing

What we don't have yet

Sheet reviewed in October 2026 against the version in production.

Where the data lives

Each agency has its own instance. It is not an account on a system shared with other agencies: it's your server, your database and your file storage.

Region: Frankfurt (Germany), European Union. Server, database, files and backups.
Instance: Dedicated to your agency: your own server, database and storage, inside a private network.
Database: Holds only your agency's and your clients' data. Not shared with any other agency.
Files: Storage of your own per agency, encrypted at rest. Every upload and every download uses a signed link that expires.
Domain: The portal is served on your subdomain (clients.youragency.com) with its own certificate.
Provider: Accelera Nova Solutions SL (Madrid). We set the instance up, we run it and we answer for it.
Machines: One per agency. No high availability: if it fails, it's restored from the backup (see “Backups and continuity”).

Cookies and analytics on this website (portaliaflow.com) are a separate matter, covered in the privacy policy.

Who sees what

Four roles, each with its own permissions. Access is by invitation only: nobody gets into your portal unless you or a manager invited them.

Owner

Everything: clients, team, workflows, finances, email templates and brand settings. The only one who sees rates, payroll and payments.

Manager

Creates client spaces, manages tasks and workflows and approves pieces. Doesn't see the team's payroll or retainers.

Editor (team or freelancer)

Their tasks and the pieces they take part in. They don't approve what they produce and don't see costs or payroll.

Client

Only their space: approvals, calendar, library and their health. Nothing from the agency side.

What the client never sees

Your agency's other clients.
The team's internal conversations on a task: notes and @mentions never reach the portal.
Costs, rates, freelancer payments and finances.
Create buttons: their menu is Home, Approvals, Content, Library and Integrations.

What gets recorded

Every approval, with person, date and version. Requesting changes requires a written note.
Every status change on a piece, with who made it and when.
Every email sent: delivered, bounced, complained or opened.
Every login: successful, failed and blocked, with its IP address. There is no screen to browse them yet: you ask us.

How it's protected

What's in production today, without adjectives.

In transit

HTTPS with TLS 1.2 or higher between the browser and the portal, on mobile too.

At rest

Disks and file storage are encrypted. Passwords are stored hashed, never in clear text; any Google credentials someone connects are encrypted.

Passwords

Twelve characters or more, with complexity rules. Reset by email with a single-use link. Changing or resetting a password closes every open session.

Attempts and perimeter

Login attempts are limited and then blocked. A web firewall with managed rules and a per-IP limit. The server only answers to your portal's domains.

Files

Up to 25 MB per file (images, PDF, office documents, video, zip). Upload and download links are signed and expire; nothing is public.

Isolation per space

Every request is checked against the client's space. The code that keeps each client's data apart has automated tests.

Backups and continuity

What happens if something breaks.

Daily database backup

Every day, in the early hours. The last seven days are kept on the server and, on top of that, a copy with no expiry in encrypted storage inside the EU.

Daily disk snapshot

A daily snapshot of the server's whole disk, kept for seven days.

Before every change

A backup is taken before every update that touches the database and before every restore.

Tested restores

Restoring has its own procedure and it's tested. It's not just “we have backups”.

Alarms

If a backup doesn't run, an alarm reaches our team.

What would be lost

The backup is daily: at worst, what was done since the last one. No high availability: if the server goes down, it's restored; there is no recovery time guaranteed by contract.

Automatic clean-up

Read notifications and old events are deleted automatically every day. Working data (pieces, approvals, files) is never deleted on its own.

What we don't have yet

So you don't promise it to your client.

Two-factor authentication (MFA)

Access is with email and password. No second factor and no security keys.

Sign in with Google or Microsoft (SSO)

No social or corporate sign-in.

Certifications

We don't hold ISO 27001 or SOC 2, and we don't hang a “complies with GDPR” badge on it. We tell you where the data lives, how it's protected and what's missing.

Data processing agreement inside the app

If you need one, we go through it on the call and sign it outside the portal, before we start.

Self-service export and deletion

There is no “download my data” or “delete my account” button: deletion is done by an administrator on request. Files, yes, can be downloaded from the Library.

High availability

One machine per agency. On failure it's restored from the backup; there is no second machine standing by.

End-to-end encryption up to the server

Encryption covers the path from the browser to our delivery network. The last leg, inside the private network, is unencrypted.

A screen for the access log

Logins are recorded, but there is no screen to browse them yet: you ask us.

If a client of yours requires any of these, tell us on the call: better to know before anything is set up.

This is only the security side. The list of everything the product doesn't do, with what there is instead, is in What it doesn't do (yet).

Questions your client will ask you

The ones that usually land on the agency owner, with the answer you can give.

Where is my data?: In Frankfurt (Germany), in the European Union, on an instance dedicated to your agency. It is not shared with other agencies.
Who at the agency can see my files and my pieces?: The people at your agency with access to their space, according to their role. Nobody from another client: each space is isolated.
Can the agency's other clients see my data?: No. Each client only sees their own space, and that separation is checked in the code with automated tests.
Is there any artificial intelligence reading my content?: No. There is no AI feature of any kind in the portal.
Can I download my files?: Yes, from the Library in their space, for as long as they have access. There is no automatic export of all the data in an account.
What if I forget my password or share it by mistake?: It's reset by email with a single-use link and, when that happens, every open session is closed. The agency owner can reset it too.
Will my clients get emails from PortaliaFlow?: No. Emails go out from your agency's sender, with your name, from a verified domain and in each person's language. PortaliaFlow doesn't appear.
Do you sign a data processing agreement?: We go through it on the call and, if needed, sign it outside the portal before we start. There is no agreement to accept inside the portal.
What happens to the data if I leave PortaliaFlow?: The instance is yours: your own server, database and files. What you get back and when it's switched off is put in writing before we start.

The ones on this page and on the others, together: every question, on one page

If they ask you by email

Reply ready to copy (without naming us: the portal carries your brand)

Hi [name]. About your IT team's question: the portal where you approve the pieces runs on an instance dedicated to our agency, hosted in the European Union (Frankfurt). The server, database and files are ours and are not shared with other companies.

The connection is encrypted (HTTPS), disks and files are encrypted, and there is a daily backup with tested restores. Only the people we invite can get in, each with their own role, and you only see your own space. Every approval is recorded with a name and date.

What it doesn't have today: two-factor authentication or Google sign-in, and no ISO certifications. If you need anything in writing, we'll ask the provider and pass it on.

Ask us whatever your client asks you.

If your client has specific requirements, bring them to the call: we tell you what we meet today and what we don't, before anything is set up.

Request a demo

This sheet is updated when the product changes. What isn't here, we don't promise.

Security and data at PortaliaFlow · portaliaflow.com/en/security-and-data