We never ask for your broker login
Portfoli.au can't trade or move your money
You upload the file your broker gives you, or type trades in. There is no connection to your broker, so there is no broker password to steal and nothing here that can buy, sell or withdraw.
If anyone claiming to be Portfoli.au asks for your broker or bank password, it isn't us.
Where your data is kept
Your investment records are stored in a database in Sydney, Australia, with established infrastructure providers chosen for their security practices.
Files you keep in Documents are stored separately, by our hosting provider (United States), in a storage location we have asked to be in the Oceania region. That placement isn't guaranteed, so they may be stored outside Australia. They are encrypted before they leave our service.
A few services that help us run Portfoli.au, such as delivering email, operate from other countries. Our privacy policy explains where personal information may go and why.
Encryption
- On the way: everything between your browser and Portfoli.au is encrypted with HTTPS. Browsers are told never to connect without it.
- When stored: your records are encrypted at rest using industry-standard encryption, and the connection to the database is encrypted too.
Documents
Every file is encrypted with a key of its own
Each file you upload to Documents is encrypted before it's stored. Its key is itself encrypted with a separate key that isn't kept with the files, so the stored files can't be read on their own.
- Where they are kept is under Where your data is kept above.
- An accountant you invite sees none of your documents unless you share them: all of them, or only the folders you choose. Each download they make shows in that file's history with their name.
- A file you delete can be restored for 30 days, then it's removed.
More on the Documents page.
Signing in
- Your password is stored only as a one-way hash, using a method current security guidance recommends for passwords. Nobody at Portfoli.au can see it, and we can't send it to you.
- New accounts confirm their email address with a one-time code.
- Repeated wrong passwords are slowed down, to make guessing a password impractical.
- Password reset links work once, and only for a short time.
- You can sign in with Google instead of a password. If you have two-step sign-in on, it still asks for your code. Connecting or disconnecting Google sends you an email.
- You can turn on two-step sign-in in Settings: after your password, you enter a six-digit code from an authenticator app on your phone. Recovery codes get you in if you lose the phone, and we email you whenever it's turned on or off or a recovery code is used.
- If your password or email address changes, every other device is signed out and we email you to say it happened.
- Use a password you don't use anywhere else. A password manager makes that easy.
Your devices
- You are signed out automatically after a period without use.
- In Settings you can see where you are signed in, and sign out any device you don't recognise.
Your records are private to you
Each account's records are kept apart inside the database itself, not only by the website, and this is tested every time we change the service.
Sign-ins, account changes and security events are recorded in a log that can be added to but not changed.
Payments
Payments are handled on our payment provider's own secure checkout and billing pages. Your card details go straight to them and never reach Portfoli.au.
Your data, your control
- Download your transactions and your net worth as spreadsheet files from Settings at any time, and every document as a zip from Documents.
- Close your account from Settings. What happens to your records then, including what tax law says must be kept, is in the privacy policy.
Found a problem?
If you think you have found a security issue, email support@portfoli.au with what you found and how to see it. Please give us a chance to fix it before telling anyone else.