Security and privacy
Your visitors tell Porto things about their business. Here is exactly where that information goes, who can see it and how long we keep it.
How a conversation moves
1
Visitor’s browser
The chat on your site. Answers are sent over an encrypted connection.
2
Porto
Stores the conversation and brief in our database, encrypted at rest.
3
AI model
Reads each message to decide what to ask next and to write the brief. Not used to train models.
4
Your tools
The brief goes to the CRM, inbox or Slack channel you connected.
Where data is stored
Conversations and briefs live in a managed Postgres database in the United States (Virginia). The app runs on managed cloud hosting.
Encryption
Everything is encrypted in transit with TLS and at rest by our database provider.
The AI model
Each client chooses its model. The Porto model runs on an open model served by hosts that keep no conversation data. Plus and Premium use Claude by Anthropic, whose commercial terms rule out training on your data. No conversation is used to train any model.
How long we keep it
Twelve months by default. Each client can set it between three and twenty four months, after which conversations are deleted.
Who can see it
Your team members, and Porto staff when you ask for help or during your monthly review. Accounts use single sign on or email links, never shared passwords.
Visitor requests
If a visitor asks to see or delete what they shared, you can export or delete it from Settings, or we do it for you within 30 days.
AI disclosure
Every conversation starts by saying the visitor is talking to an AI assistant. This can’t be switched off.
If something goes wrong
We notify affected clients within 72 hours of confirming a breach, with what happened and what we did about it.
Subprocessors
Companies that process data for us. We’ll email clients 30 days before adding a new one.
Company
What they do for us
Location
Fireworks AI
Hosts the Porto model, with no data kept
United States
DeepInfra
Second host for the Porto model, with no data kept
United States
Groq
Backup model host, with zero data retention
United States
Anthropic
Claude models, only for clients on Plus or Premium
United States
Supabase
Database and file storage
United States (Virginia)
Vercel
Application hosting and the AI gateway
Global edge, United States origin
Resend
Sending briefs and notifications by email
United States
Paddle
Billing and payments, as reseller of record
United Kingdom
Google Workspace
Company email and documents
United States
Need a security questionnaire filled in?
Porto doesn’t have a SOC 2 report yet. Send us your questionnaire and we’ll answer it, usually within three business days.
security@porto.work