Data encryption and security

What actually protects a document in Pertavo, stated plainly — and the claims we do not make.

2 min readReviewed 17 September 2026

This is the page to send a client who asks whether the portal is safe. It says what the product does and, at the end, what it does not claim.

Files are never public

A document link is useless to anybody outside your firm. Every time a file is opened the portal checks who is asking and which firm they belong to before sending any of it. There is no “anyone with the link” mode to turn on by accident.

One firm cannot reach another

Another firm’s files are not hidden from you — they are never fetched at all. Every request is narrowed to your own firm before it reaches the database. The same narrowing is what keeps one client from reaching another client’s documents.

Sessions expire on their own

The key your browser holds after signing in expires within the hour and is renewed quietly in the background while you work. A session copied off a machine stops working by itself rather than lasting until somebody notices.

In transit

Traffic between your browser and the portal travels over HTTPS. Documents are not emailed as attachments at any point in the normal flow, which removes the single leakiest step in how firms usually move client papers around.

Roles are enforced on the server

What each person may do is decided on our side, not by what the screen happens to show them. Guessing a URL for a screen your role does not have gets a refusal, not the screen.

What we do not claim

Pertavo has not been audited or certified against SOC 2, ISO 27001 or HIPAA, and is not described here as “GDPR compliant”. No such attestation exists for this product today, and a compliance badge a firm relies on and later discovers is decorative is worse for that firm than no badge at all.

What you can tell a client is what is on this page: the specific things the product does, each of which is true. On data protection obligations specifically, see GDPR and data protection.

Reporting something

If you think you have found a security problem, write to support with what you did and what happened, rather than posting it anywhere public.

This did not answer it?

Sign in and write to us from Help & Support inside the portal — a message from there arrives with your firm and your account already attached, so nobody has to ask you which is which.