Trust & data
How Portraits handles your data
360° feedback is sensitive by nature, so you deserve a plain answer to where it lives and who touches it. This page lists what we can verify — nothing more.
Where your data lives
Your data is stored in Neon PostgreSQL, hosted in AWS eu-west-2 (London, UK). It is encrypted in transit and at rest by the database provider.
Portraits keeps no file or blob storage. Anything you upload is processed in-memory and never written to a storage bucket.
AI and your data
AI features — such as drafting report summaries and themes — are processed by Anthropic’s Claude API. Inputs sent to the API are not used to train Anthropic’s models.
Organisations that prefer their own commercial relationship with Anthropic can bring their own API key: a BYOK option is available in organisation settings, and AI requests then run on your key rather than ours.
Subprocessors
These are the third-party services that process data on our behalf.
| Name | Purpose |
|---|---|
| Vercel | Application hosting and Web Analytics (page views and public marketing action counts; no cookies) |
| Neon | Database (London, UK) |
| Anthropic | AI processing |
| Resend | Transactional email |
| Sentry | Error monitoring |
| Upstash | Redis for rate limiting and sign-in lockout state (no personal data beyond hashed keys) |
Your controls
- Organisation tenancy. Your data is scoped to your organisation — users in one organisation cannot see another’s data.
- Deletion on request. Ask and we will close your workspace and delete your organisation’s data. Once a workspace is closed, nobody can sign in to it, and its rater, nomination and development links stop working. Its 360 feedback data (participants, raters, their answers, reports and development plans) is deleted from our live systems within 30 days of closure; backups are kept no more than 90 days, unless the law requires longer. For the first 28 days you can ask us to reopen the workspace, with everything as it was.
- Bring your own key. Route AI processing through your own Anthropic API key from organisation settings.
Questions
For anything this page doesn’t answer — data processing agreements, deletion requests, security questions — email rob@peopleworklife.com.
Last reviewed: 12 August 2026. See also pricing.