Built for client-sensitive workflows — and the partners who audit them.
Portiva processes tax and immigration data for advisory firms in the EU. This page is written for the people who will actually validate us: Datenschutzbeauftragte, IT leads, and partners with a fiduciary duty. No marketing claims we can't defend.
Six commitments, stated plainly.
Each one links to the section below where we explain exactly what it means in practice — and where the limits are.
EU-only data residency
All client and case data is stored and processed in EU regions. No replication outside the EU, no US sub-processor for personally-identifiable client content.
● LiveEncryption everywhere
TLS 1.3 in transit. AES-256 at rest on managed disks and backups. Per-firm encryption keys rotated quarterly, managed through our cloud KMS.
● LiveFirm-level isolation
Each firm gets its own logical workspace with isolated data, audit log, and role permissions. Cross-firm queries are blocked at the database layer, not just the UI.
● LiveRole-based access
Partner, advisor, reviewer, client — four roles, least-privilege by default. Every access event is logged per-firm with actor, action, and resource.
● LivePseudonymisation for AI
Before case content reaches the model provider, names, IDs and addresses are replaced with stable tokens. The firm workspace sees the real values; the model does not.
● LiveConfigurable retention
Each firm sets its own retention window for intake transcripts, generated briefs, and document uploads — down to zero for transcripts if required by Berufsordnung.
● LiveWhere the client's data lives, step by step.
Click any node to see what's happening at that point — the auth, the encryption boundary, and where the data is persisted.
Inbound tax inquiry — from first message to consultant brief
● 4 nodes · 3 boundariesLawful basis, roles, and the rights your clients keep.
GDPR compliance isn't a logo — it's a clear answer to three questions. Here are ours.
Performance of a contract, plus consent where required.
Processing the client's inquiry rests on the firm's contractual relationship with the client (Art. 6(1)(b)). Special categories of data (health, tax-residency history, biometric for KYC) require explicit consent, captured at intake.
- Primary
- Art. 6(1)(b) — contract
- Fallback
- Art. 6(1)(a) — consent
- Special
- Art. 9(2)(a) — explicit
Your firm is the controller. Portiva is the processor.
The advisory firm decides the purposes and means of processing. Portiva only processes data on documented instructions — the DPA / AV-Vertrag. We don't use client data to train models, benchmark between firms, or market back to your clients.
- Controller
- Advisory firm
- Processor
- Portiva GmbH
- Contract
- DPA / AV-Vertrag (Art. 28)
Access, rectification, erasure — all routed through your firm.
The client addresses data-subject requests to the firm. Portiva provides tooling: per-client export (Art. 15), in-place edit (Art. 16), and hard-delete-on-request (Art. 17) with a signed completion receipt. Standard turnaround: 5 business days.
- Access
- Self-service export
- Erasure
- ≤ 5 business days
- Receipt
- Signed, timestamped
EU-only. Frankfurt primary. No US transfers for client content.
The short version for IT: regions, network, crypto, and backup policy on one screen.
Data location
Firm-level isolation, four roles, least-privilege by default.
Cross-firm boundaries are enforced at the database layer — not just the UI. Every request carries a firm-scoped token that the data layer validates before it runs.
How isolation actually works
Every row in Portiva is tagged with a firm_id. Postgres row-level security (RLS) is enabled per-tenant, so a query with the wrong firm scope returns zero rows — not a filtered subset. Even a compromised internal service can't leak across firms.
- Separate logical workspace per firm, shared infra
- Per-firm encryption keys (tenant-specific KMS aliases)
- Per-firm audit log, exportable
- Dedicated-tenant hosting available on request for Enterprise
Role permission matrix
Defaults · override per-firm| Capability | Partner | Advisor | Reviewer | Client |
|---|---|---|---|---|
| View case list | ✓ | ✓ | ✓ | — |
| View own case | ✓ | ✓ | ✓ | ✓ |
| Edit brief | ✓ | ✓ | comment | — |
| Assign / reassign | ✓ | own | — | — |
| Invite users | ✓ | — | — | — |
| Export data | ✓ | own cases | — | own |
| Delete on request | ✓ | — | — | — |
| View audit log | ✓ | — | — | — |
How long we keep things — and how the firm controls it.
Defaults are listed below. Each firm can tighten them per data class (transcripts, briefs, uploads) in workspace settings. We can't make them looser than the defaults.
Intake
Message arrives. Pseudonymisation applied, raw transcript encrypted at rest, indexed per firm.
Live case
Transcript, structured facts and brief held in hot storage. Audit log captures every access.
Archive
Moved to cold storage. Transcript purged by default after 90 days. Brief retained per firm setting.
Purge
Hard delete, cryptographic erasure of per-case key. Signed completion receipt to firm admin.
Every third party that touches data, listed in one table.
Firms get 30-days notice before any sub-processor change via the admin email on the account. Target sub-processor list — contracts committed before pilot launch.
| Vendor | Purpose | Data processed | Region | DPA |
|---|---|---|---|---|
| AWS EMEA | Primary hosting & storage | All case data (encrypted) | EU — Frankfurt | ◐ Committed by launch |
| Hetzner | Application compute (DE) | Application-layer only | EU — Falkenstein | ◐ Committed by launch |
| Mistral AI | Language model (EU) | Pseudonymised content only | EU — France | ◐ Committed by launch |
| Anthropic | Language model (fallback) | Pseudonymised content only | EU routing | ◐ In review |
| Resend | Transactional email | Email address + subject line | EU — Ireland | ◐ Committed by launch |
| Plausible | Product analytics | Aggregate usage, no PII | EU — Germany | ◐ Committed by launch |
| Sentry EU | Error monitoring | Stack traces, scrubbed | EU — Frankfurt | ◐ Committed by launch |
What's in place today, and what we're still working on.
Honesty matters more than badges at this stage. We tell you what's live, what's in progress, and what we haven't started. If a partner needs something from the right column before piloting, say so — we may be able to accelerate.
In place today
● 7 controls-
GDPR baselineDPA / AV-Vertrag, DPIA template, sub-processor registry, 72-h breach notification commitment.
-
EncryptionTLS 1.3 in transit, AES-256 at rest, per-firm keys via KMS, quarterly rotation.
-
Access controlSSO (Google, Microsoft), SAML on Enterprise, mandatory MFA for admins, per-firm RLS.
-
Logging & auditPer-firm audit trail, immutable, exportable; actor / action / resource / timestamp.
-
Secure SDLCCode review on every change, automated dependency scanning, secrets never in repo.
-
Backup & DRNightly encrypted backups, PITR 7 days, DR region in Dublin, quarterly restore test.
-
PseudonymisationPre-model tokenisation of PII, documented in the sub-processor DPA.
On the roadmap
◐ 4 in progress-
ISO 27001Gap assessment complete · Stage-1 audit scheduled Q3 2026 with a German accredited body.
-
SOC 2 Type IIn observation window (started Feb 2026). Type I report expected mid-2026; Type II to follow.
-
External pen-testFirst engagement scheduled May 2026 with Cure53. Summary shareable under NDA after remediation.
-
TISAX & C5Evaluating both for 2027 depending on pilot firms' requirements — no commitment yet.
-
What we don't claimNo HIPAA, no FedRAMP, no on-prem deployment today. We'd rather say no than pretend.
Designed around the professional obligations German and Austrian advisors actually carry.
Verschwiegenheitspflicht
All staff under signed confidentiality covering §203 StGB. Access to firm data requires an explicit Verschwiegenheitserklärung on file.
AV-Vertrag (Art. 28 DSGVO)
German-language DPA template, aligned to BfDI guidance. Editable clauses for Unterauftragsverarbeiter and sub-processor approval workflows.
Berufsordnung compatibility
Reviewer separation, case locking, and no-training guarantees aligned to StBerG §57 and BORA §2. AI-assisted, advisor-signed workflow.
DATEV & Unternehmen Online
Read-only integration with DATEV case folders on the roadmap Q4 2026. Today: structured CSV / JSON export of any case in one click.
If something goes wrong, here's who we tell and when.
Our incident response policy is short and designed to keep the firm fully informed — not to buy us time.
Breach notification — what happens in the first 72 hours
- T + 1 h — On-call engineer paged. Incident channel opened. Scope containment begins.
- T + 6 h — Preliminary scope determined. Affected firms identified. Holding statement prepared.
- T + 24 h — Affected firm admins contacted by phone and email. Incident portal access provisioned.
- T + 72 h — Controller-facing notification delivered, meeting Art. 33 GDPR timeline. Regulator notification if thresholds met.
- T + 14 d — Post-mortem shared with affected firms. Remediation plan with dates and owners.
Security team
One inbox, monitored by the engineering team on-call. We answer every message within one business day, even if the answer is "we need more time to investigate."
[Legal entity — TBD]
Berlin, Germany
The six we hear most.
If yours isn't here, write to security@portiva.eu — we'll answer in plain language and add it to this page if it's a common one.
Review Portiva with the people who will need to sign off.
Download the one-page security overview, forward it to your Datenschutzbeauftragte, and bring their questions to a 30-minute security-only call. No intake demo — just their questions, our answers.