Security
Last updated: September 11, 2026
Data Encryption
PortraitPay applies access controls and security measures appropriate to the service configuration. The exact controls may vary by deployment and service provider; this page does not promise a particular cipher, protocol, or biometric storage design.
Access Control
Role-based access control (RBAC) ensures only authorized personnel access sensitive data. All access is logged and audited. Multi-factor authentication is required for administrative accounts.
Infrastructure
Hosted on reputable cloud infrastructure (Vercel for app, plus managed database). Data is encrypted at rest and in transit. We do not currently hold third-party security certification; uptime SLA is best-effort.
Compliance
We follow industry-standard security practices including access logging, encrypted storage, and rate-limited authentication. We do not currently hold third-party security certification. Independent security audits are not performed annually at this stage.
Incident Response
We maintain procedures for investigating and responding to security incidents. If an incident occurs, notifications and remediation will follow applicable law and the facts of the incident.
Data Privacy
PortraitPay AI does not sell or share your personal data with third parties for advertising purposes. All data processing is conducted in accordance with GDPR and CCPA.
Cryptographic Standards
Where enabled by the relevant feature and deployment, PortraitPay may use hashes, signatures, manifests, or other integrity controls to make changes detectable. These controls do not establish authorship, ownership, originality, identity, infringement, or the outcome of a dispute.