Security Practices

This page explains how Portal VII protects your data and what we ask of you.

Our Security Commitment

1. Introduction

At Portal VII, Inc. ("Portal VII"), security is the cornerstone of our mission to deliver quantum-resistant cybersecurity solutions to enterprises, governments, and individuals worldwide. We understand that trust is built on transparency and excellence in protecting your data. This Security page outlines the measures we take to ensure the confidentiality, integrity, and availability of your information while using our website (www.portalvii.com), services, applications, and related platforms (collectively, the "Services").

Our commitment to security is embedded in every layer of our operations, from infrastructure to application development, ensuring that your data is safeguarded against current and future threats, including those posed by quantum computing advancements.

2. Security Framework

Portal VII takes a layered approach to protecting your data:

  • Post-Quantum Cryptography: Our products are built around NIST's post-quantum standards (ML-KEM and ML-DSA, FIPS 203 and 204). Traffic to our websites is protected with TLS from our hosting platform.
  • Least Privilege: Access to systems and data is limited to the people and services that need it.
  • Secure Development: We follow secure coding practices and keep our software and dependencies up to date.

3. Infrastructure Security

Our Services run on established cloud platforms:

  • Cloud Security: We host our Services on established cloud providers that hold their own SOC 2 Type II and ISO 27001 certifications. Those certifications cover the providers' infrastructure, not Portal VII itself.
  • Network Protection: Our hosting provider's platform firewall and DDoS protection sit in front of our Services.
  • Edge Delivery: Our sites are served from our hosting provider's global edge network.
  • Physical Security: Physical data-center security is handled by our cloud providers under their own certified controls.
  • Device Security: Devices used to work on our Services are kept up to date with security patches.

4. Application Security

We build security into how we develop software:

  • Secure Development Practices: We follow OWASP Top 10 guidance and secure coding standards.
  • API Security: Sign-in uses OAuth 2.0 providers, and our APIs validate the input they receive.
  • Monitoring: We review application logs and metrics to spot and respond to suspicious activity.
  • Patching: We apply security updates to our software and dependencies promptly.

5. Data Security

We protect your data with the following practices:

  • Encryption: Data is encrypted in transit with TLS and at rest by our hosting and database providers.
  • Access Controls: Access to sensitive data is limited to authorized personnel.
  • Data Anonymization: Where possible, we anonymize data to reduce risk while maintaining utility for analytics and research.
  • Backups: Backups follow our database provider's backup and encryption controls.

6. Compliance

Portal VII does not currently hold third-party security certifications such as ISO 27001, SOC 2 or FedRAMP. We use the following laws and frameworks to guide our practices:

  • GDPR Compliance: We comply with the General Data Protection Regulation for handling personal data of EU residents.
  • CCPA Compliance: We adhere to the California Consumer Privacy Act for California residents.
  • NIST Cybersecurity Framework: Our security practices align with the NIST framework for managing cybersecurity risks.

7. Incident Response

If a security incident occurs, we act to limit its impact and keep you informed:

  • Incident Identification: We investigate reports and alerts to confirm and classify incidents.
  • Response and Mitigation: We contain, mitigate, and remediate confirmed incidents.
  • Notification: We notify affected users within 72 hours of confirming a data breach, as required by law (e.g., GDPR).
  • Post-Incident Review: We conduct a thorough review to identify root causes and implement corrective actions to prevent recurrence.

For more information on our incident response process, contact security@portalvii.com.

8. Security Awareness

Everyone who works on our Services is expected to handle data responsibly:

  • Responsible Handling: Team members are expected to follow our data-handling and incident-reporting practices.
  • Confidentiality Agreements: All employees sign confidentiality agreements and are bound by strict data protection policies.

9. Third-Party Security

We work with third-party vendors to deliver our Services. We choose them carefully and limit what we share:

  • Vendor Selection: We review vendors’ security practices before using them.
  • Data Protection Terms: We use vendors whose terms include data protection commitments.
  • Minimal Data Sharing: We share only the minimum data necessary for vendors to perform their services.

10. Customer Security Responsibilities

While Portal VII works to secure our Services, customers also play a role in maintaining security:

  • Account Security: Use strong, unique passwords and enable multi-factor authentication (MFA) where available.
  • Device Security: Ensure your devices are protected with up-to-date antivirus software and secure configurations.
  • Secure Communication: Use secure channels (e.g., HTTPS) when interacting with our Services.
  • Incident Reporting: Notify us immediately at security@portalvii.com if you suspect a security incident.

11. Contact Us

For questions, concerns, or to report a security vulnerability, please contact our Security Team:

For responsible disclosure of vulnerabilities, please refer to our responsible disclosure contact.