Client portal privacy notice
Draft - review with counsel before publishing.
This notice explains how Credantic Technologies LLC ("Credantic", "we", "us") handles information in the client portal at portal.credantic.com (the "Portal"). It covers the people invited to use the Portal. It does not cover the public website, which has its own privacy policy, and it does not replace the confidentiality and data-protection terms of the agreement between Credantic and your organization (the "Agreement"). Where the Agreement and this notice differ about Client content, the Agreement controls.
1. What the Portal collects
Account data. Your email address (which is your username), your name, your job title if we enter one, your role (client or Credantic staff), the organization you belong to, whether the account is active, when you were invited and when you accepted, the time of your last sign-in, and the version of the Portal Terms you accepted and when. Your password is not stored as text. It is stored as a salted one-way hash created by the ASP.NET Core Identity password hasher.
Two-factor authentication data. If you turn on two-factor authentication, the authenticator key and your recovery codes are stored in the Portal database so that the Portal can check the codes you enter. The Portal encrypts these values before writing them to the database, using ASP.NET Core Data Protection. The keys that do this are themselves encrypted with a secret held in the Portal's server configuration and not in the database. Recovery codes are shown to you once when they are generated.
Security and audit records. We keep an audit trail of sign-ins, failed sign-ins, lockouts, sign-outs, invitations, account changes, document uploads, downloads and approvals, and administrative actions. Each entry records the time, the account email, the action, the item concerned, a short description (for example a document title and file details), the IP address the request came from and the browser user agent. Sign-in rate limiting also uses your IP address while it is in use.
Project and account content. Projects, milestones, activity feed entries, support requests and the messages in them (including your name and the time), and invoice details such as number, description, amount, dates and status. If an invoice has a payment link, payment happens on the page of a third-party payment provider [PAYMENT PROVIDER - owner to confirm]. The Portal does not collect or store card numbers.
Documents. Files uploaded to the Portal by you or by Credantic, with their title, original file name, type, size, upload time, who uploaded them and a SHA-256 fingerprint of the file contents, which we compute when the file is stored.
Approval records. When you approve a document, we record your name and email, the time, the IP address and browser user agent of your request, the document's SHA-256 fingerprint at that moment, and any comment you add. These records are kept as evidence of the approval and are not edited.
Cookies and local storage. The Portal uses strictly necessary cookies: a session cookie that keeps you signed in (it lasts 8 hours and is renewed while you use the Portal; "Keep me signed in" keeps it across browser restarts within that window), a security cookie that protects forms against forgery, and short-lived cookies used during two-factor sign-in and status messages. It stores your light or dark theme choice in your browser's local storage. The Portal does not use advertising cookies and does not include third-party analytics [CONFIRM].
Technical logs. The Portal and the systems it runs on keep operational logs, such as request paths, response status, timing and errors, to keep it running and to investigate problems. Network and access providers in front of the Portal may also log connection data, including IP addresses [CONFIRM: provider and log retention].
Email. The Portal sends invitations, approval requests, invoice notices, support replies and password-reset messages to your email address. These are service messages and are not marketing.
2. Why we use it
- To create and secure accounts and confirm it is you signing in.
- To deliver the services: show projects, documents, invoices and requests to the right people, and record approvals.
- To keep the Portal secure, investigate misuse, and meet security and audit needs.
- To send service notices.
- To support you, troubleshoot and improve the Portal.
- To meet legal, tax, accounting and contractual duties and to establish or defend legal claims.
We do not sell your information, and we do not use Portal content for advertising.
3. Who can see it
Only Credantic staff who need the information to deliver the services or run the Portal can see a Client's content. Users from one Client cannot see another Client's content: the Portal scopes what each client account can reach to that account's own organization. Within a Client, the people invited by that Client can see what the Portal shows their organization.
4. Where it is hosted and who helps us run it
The Portal is hosted at [HOSTING LOCATION - owner to confirm: provider or facility, city and country].
We use service providers (subprocessors) that may process information for us. [SUBPROCESSOR LIST - owner to confirm each entry before publishing.]
| Purpose | Provider | Information involved |
|---|---|---|
| Hosting and compute | [HOSTING PROVIDER] | All Portal data |
| Network access and protection | [NETWORK PROVIDER - for example Cloudflare] [CONFIRM] | Connection data, IP addresses, traffic to and from the Portal |
| Outbound email delivery | [EMAIL PROVIDER] | Recipient name and email, and the content of service emails |
| Off-site backup storage | [BACKUP STORAGE PROVIDER - for example Backblaze B2] [CONFIRM: in use] | Encrypted backups of the Portal database and uploaded documents. The provider does not hold the decryption key. |
| Payment pages (if invoices carry a payment link) | [PAYMENT PROVIDER] | Whatever you enter on their page, under their terms |
We require providers to protect information and use it only to provide their service to us. We may also disclose information to professional advisers under confidentiality duties, and where the law, a court or a regulator requires it.
5. Security measures
These measures are in place in the Portal as built. No system is perfectly secure, and we do not promise that unauthorized access can never happen.
- Passwords must be at least 12 characters and are stored as salted hashes. An account is temporarily locked after 5 failed sign-in attempts, and sign-in and account-recovery requests are rate limited by IP address.
- Credantic administrators cannot open the administrative area without a session that used two-factor authentication. Client users can turn on two-factor authentication in their security settings.
- Invitation and password-reset links work once and expire after 3 days.
- Deactivating an account or resetting two-factor authentication ends existing sessions, which stop working within about 5 minutes.
- Session and security cookies are marked HTTP-only, and in production are sent only over encrypted connections, with HSTS enabled. The Portal sets a strict content security policy and other browser security headers.
- Every query and file download for a client account is limited to that account's organization, and a second check runs before a document is served.
- Uploaded documents are stored outside the public web folder under server-generated names, only certain file types are accepted (file contents are checked, not only the extension), and downloads go through a permission check and are not cached by browsers.
- Approvals and administrative actions are written to an audit trail.
- The Portal is designed to be reached through a network tunnel and access-control layer rather than open inbound ports [CONFIRM: deployed configuration].
- Authenticator keys and recovery codes are encrypted before they are stored, and the encryption keys for them are themselves encrypted with a secret kept outside the database.
- Nightly backups of the database and documents are encrypted with a public-key scheme (age) before they leave the server, and the private key needed to read them is not kept on the Portal server. The backup process refuses to upload a backup that is not encrypted. Backups are currently kept locally for 14 days and off-site for 90 days [CONFIRM: current schedule].
Other Portal content, such as project details, messages and uploaded documents, is protected by access controls and by the hosting environment, but is not separately encrypted by the Portal application itself [CONFIRM: disk or volume encryption on the hosting system].
6. How long we keep it
- Account data: while the account exists. When the Client's engagement ends or a user is removed, the account is deactivated. We delete or anonymize it after [ACCOUNT RETENTION PERIOD] unless we must keep it.
- Project, document, invoice and support content: for the life of the engagement and then [CLIENT CONTENT RETENTION PERIOD - set in the Agreement], unless the Agreement or the law requires longer.
- Audit and approval records: [AUDIT RETENTION PERIOD - for example 7 years for approvals, to support contract and tax records]. Approval records are kept because they are evidence.
- Operational logs: [LOG RETENTION PERIOD].
- Backups: they roll off on the schedule above, so deleted items can persist in backups until those copies expire.
The Portal does not currently delete records automatically. Deletion happens when we carry out a request or a retention review [CONFIRM: process].
7. Your choices and requests
You can ask to see the information we hold about you, to correct it, or to have it deleted or restricted. Email info@credantic.com with the subject line "Portal privacy request" from the address on your account, or ask your Credantic lead. We will verify your identity first, for example by replying to the address on your account. If you are a user of a Client, we may need to involve the Client, because the Client controls its content, and some records (audit trails, approvals, invoices) may need to be kept for legal or contractual reasons. We will respond within [RESPONSE PERIOD - not more than 60 days].
You can change your password and manage two-factor authentication yourself in your account security settings.
Nevada residents: we do not sell covered information as Nevada law defines "sale". You may send an opt-out request to info@credantic.com and we will respond as described in our website privacy policy.
8. Security incidents
If an incident affects information in the Portal, we will notify the affected Client as the Agreement and the Portal Terms describe, and will notify affected individuals where the law requires, including under NRS 603A.220.
9. Children
The Portal is for business users. It is not for children and we do not knowingly create accounts for them.
10. Changes
When we change this notice we will update the version and effective date above and, for material changes, ask you to accept the updated Portal Terms when you next sign in, and notify the Client's contact where practical.
11. Contact
Credantic Technologies LLC info@credantic.com - (775) 378-4312