Compliance
Consent collection is available on every plan except Free. Retention, export, erasure, certificate downloads, and integrity checks need Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans. Starter and the Solo lifetime and AppSumo plans do not include them.
Portico includes built-in tools for GDPR and data protection. These features help you collect consent, retain data responsibly, and respond to client requests. Only owners and admins can change these settings.
Country and framework detection
Your Business country sets the privacy framework. You choose it during setup, and you can change it later in Settings > Account. Setup offers 42 countries.
Portico recognizes two frameworks: GDPR for EU countries, the UK, and Switzerland, and LGPD for Brazil. Other countries have no framework defaults. For a GDPR or LGPD country, Settings > Client experience names the framework your privacy settings follow.
For GDPR and LGPD countries, setup pre-fills consent checkboxes on every plan except Free. On plans with the retention tools, setup also pre-fills a 365-day retention period and leaves automatic deletion off.
Consent collection
Every plan except Free.
Consent checkboxes appear on a screen before the onboarding form starts. To set them up:
Go to Settings > Client experience and find the Privacy and consent section.
Enter your Privacy policy URL and Terms of service URL, if you have them.
Click Add consent checkbox and write the text clients agree to.
Turn on Required for each checkbox clients must tick before they continue.
Click Save privacy settings.
The privacy policy and terms links appear under the checkboxes. Clients accept only through the checkboxes you write. If you need acceptance of your policy or terms on record, add a checkbox that names them.
Portico freezes the checkboxes when you send an onboarding. Changes apply only to onboardings you send afterwards.
For each checkbox, Portico records the consent text, whether the client granted or declined it, and the time. It also records the client's IP address and browser user agent. These records appear in the onboarding's Compliance tab under Consent records. A client cannot complete the onboarding until their required consents are recorded.
Data retention
Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans.
Set a retention period to delete completed onboardings automatically. Once an onboarding's completion date is older than the period, Portico permanently deletes the whole onboarding. That includes answers, files, signatures, messages, comments, consent records, and payment records. Its audit entries are redacted.
To turn on retention:
Go to Settings > Client experience and find Data retention.
Enter a Retention period (days) between 30 and 3,650.
Tick Enable automatic deletion of completed onboardings past the retention period.
Click Save retention settings.
Leave the period empty to keep data indefinitely. Deletion runs in the background every few minutes.
Automatic deletion keeps running if your plan changes to one without these tools. Settings then shows Upgrade plan in place of the retention controls, so you cannot switch deletion off. Turn off automatic deletion before you change plans or your trial ends.
Data retention is irreversible. Once an onboarding is deleted, it cannot be recovered. Export anything you need before the retention period ends.
Data export (subject access request)
Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans.
When a client requests a copy of their data, export it from the client's page or from any of their onboardings. Only owners and admins can export.
Open the client's page and find Data and privacy. You can also open one of the client's onboardings and select the Compliance tab.
Under Data portability, click Export client data.
Your browser saves the client's data as one JSON file named after the client, such as
Jane_Smith.json.
The export includes:
The client's profile: name, email, company, phone, language, notes, and the date you added the client.
Form responses across all of the client's onboardings.
The name, size, and date of each uploaded file. File contents are not included.
Consent records.
Audit history, messages, field comments, payments, and signature details.
You can share the file with the client.
Data erasure (right to be forgotten)
Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans.
Erasure starts with a request and ends when you process it. Only owners and admins can do either:
Open the client's page and click Request erasure under Data and privacy, or choose Request erasure in the client's row menu on the Clients page. Click Request erasure to confirm. From that moment, the client and all their onboardings are hidden from your dashboard, and you cannot withdraw the request.
Go to Settings > Client experience and find Erasure requests. When you request erasure from the client's page, Portico opens it for you.
Click Process next to the request and confirm.
Processing the request permanently removes:
All of the client's onboardings and their answers.
Uploaded files.
Signatures and signature history.
Erasure also replaces the client's name with "[Erased]" and their email with a placeholder. It clears the company, phone, notes, locale, and custom fields. Matching audit entries are redacted, and the audit chain is sealed again.
The Erasure requests table lists each request with its Client, Status, Requested date, and By. Statuses are Pending, In progress, Erased, and Rejected. Files are removed from storage only after earlier upload links expire, and until then the row shows when that happens. After each Process, a message says whether the erasure finished. If it is not finished, click Process again. When files wait on earlier upload links, the message gives the time to wait. The Client column shows Client being erased while a request is open, and Erased client once it finishes. By shows the team member's name or email, or Former team member. The audit log records both the request and its completion. The action is irreversible.
Audit trail
Every onboarding maintains an activity log:
When the onboarding was sent, opened, completed, and reopened.
Every field submission, approval, change request, and rejection, with timestamps.
Consent events.
Signature events with IP addresses.
Payment events, such as "Payment received" or "Subscription started".
Reminder emails to the client, once the email provider accepts them, and countersignature reminders to your team.
Reminders a team member asks Portico to send, new client links a team member copies, and undone bulk approvals.
Certificate downloads.
Each entry names who acted: the client, a team member, Portico, an API integration, or a registration link.
You can view the audit trail on the onboarding detail page under the History tab. Filter it by All, Reviews, or System, or click Export CSV. On Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans, Verify integrity in the Compliance tab checks the hash chain. For API access, use the Events endpoint.
E-signature compliance
Before signing, the signer reads your agreement text, shown above the signature pad, and an electronic-signing consent disclosure. You write the agreement text into the signature field's Agreement text in the template builder. A template cannot be saved with this text empty. Some gallery templates start with sample text, and Portico refuses to send an onboarding until you replace it. The signer then signs by drawing or typing.
Signature fields in Portico record:
The signature image.
Your agreement text and the consent disclosure shown at signing.
Signer's IP address and browser user agent.
Timestamp (UTC).
The client's name and email.
The signing method (drawn or typed), which is printed on the certificate.
Each signature is sealed at signing time with a stored SHA-256 record hash covering all of the above. The seal is anchored in the hash-chained audit log. The Verify signature button in the compliance panel checks it in one click. If a client re-signs, the previous signature image, agreement text, and original timestamp are archived to an append-only history. Records are never silently overwritten.
After signing, the signer receives a confirmation email that their signature has been recorded. The email does not attach a copy. On plans with the Client portal, the signer can download their own certificate from the portal. The Compliance tab is on every plan. Without these tools, it shows a panel that names them, with Upgrade plan. Members see "Ask an owner or admin to upgrade." in place of the button. Certificate, Verify signature, Verify integrity, and Export client data need Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans. Certificate downloads are recorded in the audit trail.
On the Free plan, a workspace can collect 3 e-signatures a month. Paid plans have no monthly e-signature limit.
A signature field can also require a countersignature by your team after the client signs. Portico emails the assigned team member if they are an Owner or Admin. Otherwise, including when nobody is assigned, it emails the Owner. An Owner or Admin then clicks Countersign on the field in the onboarding page. Both signatures appear on the certificate and on exported PDFs. Reminder emails go out while the countersignature is pending, at most once every 72 hours. Portico supports one countersigner and does not offer multi-signer routing or a signing order.
Portico records intent to sign, consent to transact electronically, association with the record, and retention. These are the elements ESIGN (US) and UETA look for. Under eIDAS (EU) they are simple electronic signatures. Portico does not offer advanced or qualified eIDAS signatures. It also does not offer knowledge-based identity verification, so it does not serve IRS Form 8879 workflows.
Frequently asked questions
Is Portico GDPR compliant?
Portico includes tools that support GDPR obligations: consent capture, client data export, erasure, retention, and a hash-chained audit trail. Consent collection is on every plan except Free. The other tools need Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans.
How many countries does Portico support for compliance?
Setup offers 42 business countries. Portico applies GDPR defaults for EU countries, the UK, and Switzerland, and LGPD defaults for Brazil. Other countries get no framework defaults.
Can I set automatic data retention periods?
Yes, on Pro, Business, the Pro trial, and the lifetime and AppSumo Practice and Firm plans. In Settings, set a retention period of 30 to 3,650 days and turn on automatic deletion. Portico then deletes each completed onboarding once that period passes.