Security Questions to Ask a Portfolio Vendor

Connecting a fund's wallets to a third-party portfolio provider is a vendor risk decision before it is a product decision. These are the questions a security review should ask, and what good answers look like.

Disclosure: we are one such vendor. The questions below are the ones we get asked, and they are the right ones to ask us too.

1. Do you ever hold private keys?

The only acceptable answer is no.

Portfolio tracking reads public chain data. It requires an address, not a key, and a provider asking for signing authority is asking for far more access than the job needs. Octav is read-only and never requests private keys.

This matters more than it sounds: a read-only integration cannot move funds even if the vendor is fully compromised. That single property removes most of the tail risk from the relationship.

2. What is the authentication model?

Octav Pro uses magic-link email authentication — no password to be reused, leaked or phished from a password database that should not have existed.

Ask what happens on account compromise. With read-only access and no key custody, the blast radius is disclosure of which addresses you track, not loss of funds. That is a real concern for a fund that treats its positions as confidential, but it is a different order of problem.

3. Are you SOC 2 audited, and which type?

The distinction matters and is frequently blurred:

Type 2 is the stronger assurance because it tests whether the controls actually ran, not just whether they exist on paper. Octav is SOC 2 Type 1 and Type 2 compliant; evidence is at trust.octav.fi. The distinction is worth understanding properly — What SOC 2 Type 2 Means for Portfolio Data.

Ask for the report, not the badge. A logo on a marketing page is not an audit.

4. What data do you retain, and where?

Specific questions worth asking any provider:

• Which addresses are stored, and for how long?
• Is portfolio history retained after an account closes?
• Where is data hosted, and does that satisfy your jurisdiction?
• Who internally can see customer address lists?

For a fund, the address list is the sensitive asset. Positions are public on-chain, but the mapping from "these addresses belong to this fund" usually is not, and that mapping is exactly what a portfolio provider holds.

5. What happens if you disappear?

Vendor continuity is part of the review, particularly for anything feeding regulated reporting:

• Can portfolio history be exported in full?
• Is the data in a format usable without the vendor?
• What are the notice terms?

This is a real argument for keeping daily snapshots exportable rather than trapped in a UI. History you cannot extract is history you do not own.

6. Does the data support your audit obligations?

A security review and an audit review overlap here. If the provider feeds NAV, the auditor will want reproducibility — the same query returning the same answer months later. That is a data-architecture property, not a security one, but it gets discovered during vendor review. See What Is NAV Reporting for Crypto Funds? and Crypto Transaction Reconciliation for Audits.

The short checklist

1. Read-only, no private keys — non-negotiable.
2. SOC 2 Type 2, with the report available.
3. Clear retention and residency answers.
4. Full export of your own history.
5. Reproducible historical data if it feeds reporting.

A provider that answers all six well is a reasonable risk. One that treats these questions as friction is telling you something.