How we protect the Anchor platform and the client portals your team signs in to — the controls, data handling, and sub-processors an IT or security reviewer needs to approve us.
Last updated July 4, 2026
The third parties that may process portal data. Primary infrastructure is US-based; the optional integrations receive data only when your delivery team connects them. This list — and our DPA — never requires an NDA.
| Sub-processor | Data it handles | Region | Purpose |
|---|---|---|---|
| Vercel | Portal traffic; documents, attachments, logos | US | Hosting, CDN, compute, file storage |
| Supabase | Portal content and metadata | US (AWS) | Managed PostgreSQL database |
| Upstash | Throttling counters (no portal content) | US | Redis — rate limiting |
| Resend | Invite and survey emails (the sign-in link) | US | Transactional email |
| Anthropic | Meeting transcript/summary, when enabled | US | AI — client-facing meeting recaps |
| Pusher | Internal notifications (your browser doesn't subscribe) | US | Real-time staff notifications |
| Sentry | Diagnostics, with tokens/credentials redacted | US | Error & performance monitoring |
| Slack | Ticket content, only when your team connects it | US · optional | Team messaging |
| Atlassian Jira | Ticket content, only when a project is connected | US · optional | Issue tracking |
The questions security and IT teams most often ask before approving the portal.
There are no portal passwords. Each contact receives a personal, single-use sign-in link by email. The link carries a 256-bit random token that is stored only as a salted PBKDF2-HMAC-SHA256 hash (100,000 iterations) and verified with a constant-time comparison; the raw token is never written to our database. Links are single-use (atomically consumed the first time they sign you in), expire after 7 days, rotate on each send, and can be revoked; a successful sign-in grants a 24-hour host-scoped, HTTP-only browser session. Sign-in and link-request endpoints are rate-limited per source IP to resist automated guessing.
No. Each portal is bound one-to-one to a single project, and every query is filtered server-side by that project and organization. Support tickets are further scoped to your own account, so even a portal shared by multiple customer organizations keeps each organization's tickets separate.
In transit: yes — all portal traffic is HTTPS/TLS with HTTP Strict Transport Security, a Content-Security-Policy, and standard browser-hardening headers. At rest: portal data is stored in managed PostgreSQL (Supabase, AWS US) and managed file storage (Vercel), whose providers encrypt data at rest. In addition, third-party integration credentials are encrypted by Anchor with AES-256-GCM before storage.
Primary infrastructure is US-based: Vercel (hosting, CDN, file storage), Supabase (PostgreSQL database, AWS us-west-2), and Upstash (rate limiting). Resend sends portal emails, Anthropic generates meeting recaps, Pusher carries internal notifications, and Sentry handles error monitoring. Slack and Jira receive portal ticket content only when your delivery team connects them. A full table is in the Security & Privacy Overview.
Only to generate client-facing meeting recaps, using Anthropic's Claude model, and only when the Meeting Log is enabled. The relevant meeting transcript or summary is sent to Anthropic to produce a short recap; internal commentary is excluded from the recap. Per Anthropic's API terms, this data is not used to train models.
Yes. Every sign-in attempt — success or failure — is recorded to an audit log with the email, source IP, and outcome, and retained for 365 days. Successful sign-ins also store a session record with IP and browser user-agent.
Revocation is immediate. Each portal session is backed by a server-side record that every request re-validates, so revoking a contact's invite ends their open session on the very next request as well as blocking future sign-ins. Contacts can also end their own session with the in-portal Sign out control, and disabling the portal cuts everyone off at once. Sessions are short-lived (24 hours) regardless.
Contact name and email (to grant access); session email, IP, browser user-agent, and timestamps (to authenticate and audit); and any ticket or survey content your team submits. Text typed into the help search stays in your browser and is never sent to or stored by Anchor.
Expired sessions are permanently deleted 7 days after expiry; audit logs are kept for 365 days. Tickets, surveys, and invite records are retained for the life of the engagement and removed when the project/portal is deleted or on written request — handled within 30 days.
Yes — a GDPR Article 28 DPA is available on request (email support@anchor-hq.dev with the subject "DPA Request"). Your organization is the data controller for the contacts you invite; Anchor acts as your data processor.
Your delivery team can preview the portal as you would see it, but only when they are an authenticated member of the organization that owns your portal. An anonymous party, or anyone outside your engagement, cannot trigger this preview.
Yes. The portal has its own sign-in path and its own session cookie, fully separate from the internal staff app. The internal app's Google sign-in is never exposed to portal visitors, and the portal opens no real-time socket in your browser.
The full Security & Privacy Overview and FAQ — including the detailed authentication, logging, and data-handling specifics — are in the downloadable PDFs above.
Questions about security, a Data Processing Agreement request, or to report a vulnerability, email support@anchor-hq.dev.
See also our Privacy Policy and Terms of Service.