Effective October 12, 2026 (version 2026-10-12). Questions or requests: info@portmem.com.
The marketing site (portmem.com) collects only what you submit through the access-request form: your email address. We use it to respond to your request. No advertising trackers.
The PortMem console and API (app.portmem.com) process the documents and reports you upload in order to run retrieval and verification. In the hosted tier, document text is sent to our subprocessors and stored in Google Cloud. The review model is GLM, an open model, which we run through OpenRouter at hosts based in the United States or the European Union (BaseTen, Parasail and Sail Research in the US; Inceptron in Sweden, with servers in Finland), with zero data retention required and data collection denied. NVIDIA computes the embeddings for search. A workspace that connects its own model account runs the review model on that account instead. Account, usage, and audit records are isolated with database-enforced row-level security; document content is isolated per document by access-control checks enforced in the retrieval query and again at the serving layer. The air-gap deployment tier keeps all content inside the customer boundary.
Account details: your email address and, if you give it, your name, to sign you in and to key your workspace.
Your documents and drafts: the text you upload or paste, to search it and to run the reviews you ask for.
Review results and decisions: verdicts, the evidence they cite, your sign-offs and published records, to show your history and to keep the signed record.
Usage records: how many queries and model calls each workspace makes, for billing and limits.
Security logs and assistant connections: described in their own sections below.
Google Cloud hosts and stores the service, and Firebase Authentication (a Google service) handles sign-in. OpenRouter and the review model hosts named above, and NVIDIA (embeddings), receive document text to do their part of a review, under their API data-protection terms; the review model hosts must keep none of it. Anthropic, our earlier review model provider, is kept on standby and receives document text only if we switch the review model back to it. An AI assistant you connect receives only the results of the PortMem tools it calls. The OpenTimestamps network receives cryptographic hashes, never content. Nobody else: we do not sell your data or share it with advertisers or data brokers.
The PortMem app for iPhone talks to the same API as the console and handles your documents the same way. Three things are specific to it.
Signing in. You sign in with Google, with Apple, or with an email address and password. Authentication is handled by Firebase Authentication, a Google service, which holds your email address and, if you sign in with Apple and choose to share it, your name. Your email address is the identifier your workspace is keyed to, so it appears alongside your reviews, your sign-offs, your usage records and your audit records. If you use Apple's Hide My Email, we receive and store the relay address Apple gives us, and never your real one.
Notifications. Notifications are off until you turn them on. When you do, the app registers a delivery token for your device with us so we can tell you a review has finished. A notification says only whether the gate held or cleared and how many items are flagged. It never contains your document, your report or any claim text. Turning the switch off, signing out and deleting your account each delete the token.
What stays on the phone. The app stores two things locally: the identifier of your most recent review, so reopening the app returns you to it, and your notification preference. No document text and no claim text is kept on the device.
The app contains no analytics, no crash reporting, no advertising identifier and no third-party tracking code of any kind. We do not track you across other companies' apps or websites, and we share nothing with data brokers or advertisers. The app does fetch its typefaces from Google Fonts the first time it runs, which tells Google the device's network address, and nothing else.
You can connect PortMem to an AI assistant such as Claude, ChatGPT, Gemini, Microsoft 365 Copilot, Le Chat, Perplexity or Muse. Nothing is connected until you approve it on PortMem's Connect page while signed in to your account, and each approval is written to the signed audit ledger. A connected assistant can search and add documents and run reviews in your workspace; if you tick Read only when you approve it, it can only read and search. It cannot accept a flagged claim, publish a record or change who can see a document; those stay in the console, with you.
What the assistant reads from PortMem (search results, review results, records) goes to that assistant's provider (Anthropic, OpenAI, Google, Microsoft, Mistral, Perplexity or Meta), and from there is handled under your agreement with that provider, not ours. We keep the assistant's registration (its name and the address it returns to), when you connected it and when it last renewed its access. Its access tokens are stored only as one-way hashes. Disconnect it at any time in Settings, Assistants, and its access stops at once. Deleting your account removes its connections too.
If you sign in with Google, PortMem receives your name, email address and profile picture from Google, and uses your name and email address to identify your account.
If you add files from Google Drive, Google's own picker shows your Drive and you choose the files. PortMem's permission covers only the files you pick, never the rest of your Drive. Your Google access stays in your browser: the console downloads each file you pick and, when Share as in the drive is on, reads who the file is shared with, then sends PortMem the file, its name and where it came from, and that sharing list, so the document is shared the same way in PortMem. The file is then processed like any other document you upload, as described above.
If your company's admin connects Google Workspace groups, PortMem reads your company's groups (their names and addresses) and the addresses of the people in them, nested groups included. It reads nothing else and changes nothing in Google Workspace. It keeps this list for your company's workspace only, uses it only to decide who can open documents shared with a group, refreshes it every 30 minutes, and deletes it when the admin disconnects Google Workspace groups or the workspace is deleted.
PortMem's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models, and our staff do not read it except to keep the service secure, to comply with the law, or with your permission.
In transit. Every connection to PortMem uses HTTPS (TLS), and browsers are told to reach PortMem over HTTPS only. PortMem's connections to its own database must be encrypted. When a company keeps its workspace in its own database, PortMem connects to it only over TLS and always checks the server's certificate.
At rest. PortMem stores data in Google Cloud, which encrypts everything it stores. Review records are also encrypted with a key that belongs to one workspace; when an account is deleted, the key for its personal workspace is destroyed, so those records can no longer be read. API keys and AI assistant access tokens are stored only as one-way hashes, and the service's own secrets are kept in Google Secret Manager.
Who can access it. Each workspace's data is kept apart by row-level security in the database and by an access check on every request. Inside a workspace, roles decide who may approve, publish and share. PortMem staff open a company workspace only to give support, and every such access is written to that workspace's own record and shown to its admins under Settings, Team, Vendor access.
Google user data. Your Google Drive permission stays in your browser and is never sent to or stored by PortMem; PortMem receives only the files you pick. To read Google Workspace groups, PortMem uses a service account that has no stored keys: it gets a short-lived token each time it reads, limited to the one read-only permission your admin granted. Group names, addresses and members are stored only for your company's workspace and are deleted when the admin disconnects Google Workspace groups.
Monitoring. Requests that change something, and requests that are refused, are logged (see Security logs below); the service is monitored for errors and outages; and its code and dependencies are scanned for known vulnerabilities on every change before release.
Every request that changes something, and every request that is refused, is written to a security log with the account that made it, the path, the network address it came from and the app or browser that sent it. These logs exist so that unauthorised access can be detected and reconstructed after the fact. They are kept for up to a year and are not used for analytics, profiling or marketing.
Signed evidence packets are buffered for handoff (undeletable for 1 day, automatically deleted after 2 days) and are then the customer's to archive; PortMem is not a long-term archive of your records. Evidence anchoring sends only cryptographic hashes, never content, to the OpenTimestamps network.
Documents, drafts, reviews, usage and account data are kept while your account is active and deleted when you delete them or your account. Deleted data leaves our live systems at once and our database backups within 7 days.
The signed audit ledger is kept permanently, even after deletion requests. This exception is deliberate: tamper-evident records lose their value if they can be edited or erased later. Ledger entries reference your documents by cryptographic hash and identifiers, not full content.
Security logs are kept for up to one year. Evidence packets are kept for 2 days (see above).
Assistant access uses tokens that expire: an access token after 1 hour, and a connection that goes unused for 30 days has to sign in again. Disconnecting ends access at once; the record that the connection existed is kept, marked disconnected, until you delete your account.
Your controls. Delete any document in Documents. See and disconnect connected assistants in Settings, Assistants. Revoke API keys in Settings, API keys. Delete your account and its data from the account menu in the web console (the account button at the foot of the side rail) or under Account in the iPhone app, without writing to us. Or write to the address above, and we act on requests subject to any legal obligations.
You can request access to, correction of, or deletion of your personal information at any time by emailing us. We respond to all requests, including those under GDPR, CCPA, and LGPD where applicable.
If this policy changes, the effective date above changes with it. Material changes affecting product data handling are communicated to account holders directly.