PortyLink

Security & data

Agencies trust PortyLink with access to their clients' analytics. This page explains what we hold and how we protect it. The legal version is our Privacy Policy.

Read-only, by design

  • We ask Google for read-only access only: analytics.readonly and webmasters.readonly. Nothing in PortyLink, no person, agent or key, can change anything in your Google accounts.
  • Agents and API keys get read-only tools and endpoints, limited to the sites and providers you approved.
  • We don't store your report data. Results are cached briefly (15 minutes for recent days, a day for settled ones) to protect your Google quota.

Your Google access

  • Google refresh tokens are encrypted with AES-256-GCM, each with its own key, wrapped by a master key kept outside the database. They live in a separate schema that only the credential store can read.
  • Tokens never reach browsers, agents, API responses or logs.
  • Disconnecting a Google account, or deleting your organization, revokes our access at Google as well as deleting the token.

Separation between organizations

  • Every row of customer data carries its organization, and the database itself refuses to return or write rows of another organization (Postgres row-level security), whatever the application asks.
  • The application connects with a database role that has no access on its own; it can only act inside one organization at a time. An automated test suite checks this for every table on every change.

Agents and keys

  • Agents connect with OAuth 2.1 and PKCE. Their tokens last an hour, are bound to the PortyLink MCP address, and are stored only as hashes. A stolen token that is replayed ends the whole connection.
  • API keys are stored as hashes and shown once. Revoking a key or disconnecting an agent takes effect on its next request.
  • Every key and agent has its own rate limit, so one runaway automation can't exhaust your Google quota or affect other clients.

Where data lives

In the European Union: the database and authentication run in Ireland (Supabase, eu-west-1), and our servers in Dublin (Vercel, dub1). Short-lived caching and rate limits use Upstash Redis, also in the EU.

Your controls

  • The activity log records who changed what (kept for a year); the Usage page shows every data request by key and agent.
  • Owners and admins can export everything your organization has stored as JSON.
  • Owners can delete the organization; everything is erased and Google access revoked. Anyone can delete their own account.

Report a problem

If you think you've found a security issue, email hello@portylink.com before disclosing it publicly. We'll respond quickly.