Portage security
Security and privacy, said plainly.
What a security team asks before it signs, answered in one place, including what we don’t have. Anything else, write to hello@cadenic.studio.
Last changed 27 October 2026
The short version
Portage is made by Cadenic Studios, a one-person studio in Edmonton, Canada. It runs on Vercel, and its database is held by Supabase in the eastern United States. Everything is encrypted on the way and at rest.
We don’t have a SOC 2 report or an ISO 27001 certificate, and Portage isn’t hosted in Canada. We’d rather say so here than have you find out in a questionnaire. We’ll answer your security questionnaire in writing. We’re preparing a data processing agreement; ask us.
If you’re in Quebec, Law 25 asks for a privacy impact assessment before personal information leaves the province. We’ll give you what it needs from us: what we keep, where, for how long, and who handles it.
Where Portage runs and where your data is held
Vercel hosts the site. It runs Portage’s server code and serves pages from its network, so a page can be delivered from a location near the person reading it.
Portage’s server code runs in Vercel’s Washington, D.C. region (iad1), in the eastern United States, close to the database.
Supabase holds the database, in the eastern United States. That’s every page, its versions, the pictures and files people upload, the numbers we count, sign-up lists and accounts. There is no copy of the database anywhere else, apart from Supabase’s own backups.
We don’t offer hosting in Canada or Europe yet. If you need your data held in Canada, tell us: we’d rather know than guess, and we won’t say it’s coming until it is.
Encryption
Every connection to Portage is HTTPS, and browsers are told to use nothing else for portage.camp. Our server reaches the database over TLS too.
Supabase encrypts the database and its backups at rest.
Secrets we hold for you are sealed again on top of that, with AES-256-GCM, under a key only our server has, and each one is bound to its owner, so a sealed value copied from one account opens nothing in another. That covers a newsletter service’s API key, a Rumble livestream address, the name on an ID for an identity check, an invitation link, and a company sign-in’s client secret.
There are no passwords to steal. You sign in with a link or a code we email you, or through Google, Discord, Twitch or your company’s own sign-in. Sign-in links last 20 minutes, work once, and are kept only as a scrambled hash. Sessions are signed cookies that scripts on the page can’t read, and signing out ends every session on every device.
Backups, and getting things back
Our database’s backups are kept for up to 30 days, so something deleted can stay in them until they roll over. That includes the name on your ID for a check, still encrypted, where nobody can read it without our key. Nobody reads the backups; they’re only there to recover the database if something goes wrong.
Anything removed from a page is kept for 30 days so a mistake can be undone: earlier versions of the page and the pictures and files taken off it. They can be restored from Versions in the editor.
You can download everything at any time: each page’s numbers, its versions and its sign-up list from the editor, and for an organisation, the record of every change from portage.camp/org.
Who can reach your data
One person at the studio can reach the live database and the admin screens: Wyatt McPherson, who owns Cadenic Studios. Admin access is a list of addresses kept in the hosting settings, not a setting anybody can change from inside Portage.
When the studio works on somebody’s page from the admin screens, the page’s history says it was Portage staff, and every admin action goes in an admin log with who did it, when, and the reason they gave.
Nobody’s browser talks to the database. Every read and write goes through Portage’s own server, which checks on every request who is asking and what they’re allowed to do. The database itself refuses everything else.
In an organisation, people see and change only what their role and their groups allow, and that is checked on our server on every request, never in the browser. One organisation can’t see another’s pages, people or record.
The record of every change
For an organisation on Enterprise, Portage keeps a record of every publish, every change sent for sign-off and its answer, every invitation and role change, every change to the brand rules, the locations spreadsheet and your company sign-in, every sign-in by one of your people, and every download of the record itself. It names who did it and when, and it’s kept for 2 years. Your brand team and admins can download it as a spreadsheet at any time.
When something goes wrong
If personal information is lost, or reached by somebody who shouldn’t have it, in a way that could cause real harm, we report it to the Office of the Privacy Commissioner of Canada and to the Office of the Information and Privacy Commissioner of Alberta, and tell the people affected, as Canada’s and Alberta’s privacy laws require.
An Enterprise customer’s named contact hears from us by email within 72 hours of us confirming an incident that touches their organisation’s data: what happened, what it touched, and what we’ve done.
Found a security problem in Portage? Write to us with “Security” in the subject. We’ll reply within two working days, keep you posted while we fix it, and we won’t take action against anybody who reports a problem in good faith and doesn’t reach other people’s data.
Companies that handle data for us
Vercel hosts the site and runs its server code. Everything Portage serves passes through it.
Supabase holds the database, in the eastern United States, and its backups.
Resend sends our email: sign-in links and codes, invitations to help run a page or to join an organisation, news and goods news to people who asked for them, receipts for payments made by e-Transfer, notes about your page’s safety, codes for a business check, messages sent through a page’s enquiry form and through Find someone to help, an agency’s weekly note and its monthly reports to page owners, Enterprise renewal notices, and reports about a page and custom work enquiries to the studio’s inbox. It sees the address and the message.
Wise holds the studio’s business account. When a bank transfer or an Interac e-Transfer arrives, we see the sender’s name, their bank’s country and the reference they added, and keep the last four characters of the account, never the whole number.
Didit runs the automatic identity check, only for somebody who buys one and chooses it. It reads the ID and a selfie, and we ask it to delete them as soon as the check is decided.
Google, in three small ways: Google Meet for an identity check by video call, if somebody chooses it; Google Web Risk, which is sent only the address of a link that’s new on a page, to ask whether it’s a known phishing or malware page; and Sign in with Google, for people who choose it.
Discord and Twitch, for people who choose to sign in with them. They tell us the account’s email address and username.
A newsletter service a page’s owner connects to a sign-up form (Mailchimp, Kit, MailerLite, beehiiv or Buttondown) gets each new sign-up’s email address, under the owner’s own account with it.
Google Search Console tells us how often each page at portage.camp showed up and was clicked in Google Search, and for which searches, once the studio switches it on. Google tells us nothing about the people searching.
The platforms a page lists (Twitch, Kick, YouTube, Trovo, Discord and Rumble) are asked by our server about public details, such as whether a channel is live. Nothing about a page’s visitors is sent to them.
Shopify takes card payments for gifts, page extras and Portage goods, Printify prints and ships the goods, and Judge.me, a review service connected to our Shopify store, gets a buyer’s name, email address and the pieces in their order, to send one email asking for a review 14 days after it ships. None of them has anything to do with Enterprise. Gumroad, Polar, Stripe and RevenueCat hold the record of anything bought through them before, and nothing new goes to them.
Your own company’s sign-in (Google Workspace, Microsoft Entra ID or Okta) tells us a person’s email address when they sign in through it. That’s your provider, under your contract with them, and we keep nothing from it but the address.
We tell Enterprise customers before we add a company to this list.
Accessibility statement
We aim for every part of Portage, the pages people make and the tools they make them with, to meet the Web Content Accessibility Guidelines 2.2 at level AA.
What we do: we measure the contrast of every theme’s words against its own ground, and when a page’s owner picks colours of their own, the editor tells them if anything has become hard to read and fixes it with one press. Controls have names a screen reader can read, buttons are at least 44 pixels on a phone, and pages and the editor are built to work with a keyboard alone. For anybody whose device asks for less motion, nothing in the moving landscapes travels, and any lights or stars only glow and twinkle, slowly. They can be paused on any page.
What we haven’t met yet: pictures are described by the people who put them on their pages, so a page is only as accessible as its descriptions, and the editor asks for them but can’t make anybody write a good one. Players from YouTube, Spotify and the like are those companies’ own, and we can’t vouch for them; they only load when somebody taps them. Files people upload, PDFs especially, may not be readable by a screen reader. Our 404 page doesn’t yet say what language it’s in.
We haven’t had an outside audit. We check with automated tools and by hand on real phones, and we fix what we find.
If something on Portage doesn’t work for you, write to us and tell us where. We’ll reply within two working days, and if we can’t fix it straight away we’ll help you another way.
What we’ll send your security team
Written answers to your questionnaire, whether it’s your own, SIG Lite or the CAIQ. A data processing agreement, once it’s ready: we’re preparing one, so ask us. This page, and the privacy notice and terms it points to. A named person at the studio who replies within one working day.
There is no phone line. Everything is in writing, which also means everything is on the record.
Write to hello@cadenic.studio with any questions, and we’ll reply.