We never ask for your broker login
Portfoli can't trade or move your money
You upload the file your broker gives you, or type trades in. There is no connection to your broker, so there is no broker password to steal and nothing here that can buy, sell or withdraw.
If anyone claiming to be Portfoli asks for your broker or bank password, it isn't us.
Where your data is kept
Your records are stored in Australia, in Sydney, with established infrastructure providers chosen for their security practices.
A few services that help us run Portfoli, such as delivering email, operate from other countries. Our privacy policy explains where personal information may go and why.
Encryption
- On the way: everything between your browser and Portfoli is encrypted with HTTPS. Browsers are told never to connect without it.
- When stored: your records are encrypted at rest using industry-standard encryption, and the connection to the database is encrypted too.
Signing in
- Your password is stored only as a one-way hash. Nobody at Portfoli can see it, and we can't send it to you.
- New accounts confirm their email address with a one-time code.
- Repeated wrong passwords are slowed down, to make guessing a password impractical.
- Password reset links work once, and only for a short time.
- If your password or email address changes, every other device is signed out and we email you to say it happened.
- Use a password you don't use anywhere else. A password manager makes that easy.
Your devices
- You are signed out automatically after a period without use.
- In Settings you can see where you are signed in, and sign out any device you don't recognise.
Your records are private to you
Each account's records are kept apart inside the database itself, not only by the website, and this is tested every time we change the service.
Sign-ins, account changes and security events are recorded in a log that can be added to but not changed.
Payments
Payments are handled on our payment provider's own secure checkout and billing pages. Your card details go straight to them and never reach Portfoli.
Your data, your control
- Download your transactions and your net worth as spreadsheet files from Settings at any time.
- Close your account from Settings. What happens to your records then, including what tax law says must be kept, is in the privacy policy.
Found a problem?
If you think you have found a security issue, email support@portfoli.au with what you found and how to see it. Please give us a chance to fix it before telling anyone else.