Incentive Report Portal

Security and data handling

How the portal protects your firm and your clients.

What we store

• Company name, website and business addresses.
• Optional notes your team adds to a request.
• The generated incentive report.

The portal does not ask for or store SSNs, EINs, tax returns, financial statements, payroll records or bank information. Please don't enter confidential client details in the notes field.

Where it lives

• Data is stored in Supabase (managed Postgres) and the application is hosted on Render. Both providers maintain SOC 2 Type II reports.
• All traffic is encrypted in transit with HTTPS/TLS. Stored data is encrypted at rest.
• Account emails are sent from our own verified domain.

Firm separation

• Each firm's reports and users are isolated at the database level with row-level security. A user can only read records that belong to their own firm, even if the application itself had a bug.
• Eagle Advisory Partners administrators can access firm records to provide support.

Access control

• Invitation only. There is no public sign-up; every account is created by an administrator.
• Passwords must be at least 12 characters and are checked against known breached-password lists.
• Two-factor authentication with an authenticator app is available to every user and required for all firms.
• Sessions use secure, HTTP-only cookies. Firm administrators can remove a user's access at any time.

Outside services used to build a report

• The portal reads the company's public website.
• Business addresses are matched to counties and census areas using public geocoding services (U.S. Census Bureau, Esri ArcGIS, OpenStreetMap).
• Public website text may be sent to OpenAI's API to describe the company's industry. Notes are never sent. OpenAI does not use API data to train its models by default.
• We do not sell or share client data.

Questions about security? Contact Eagle Advisory Partners at eagleadvisorypartners.com.