# Security Questions to Ask a Portfolio Vendor

> What a fund's security review should cover before connecting wallets to a portfolio provider — key custody, read-only access, SOC 2 and data residency.

- **URL:** https://octav.fi/blog/soc2-security-portfolio-data
- **Published:** 2026-03-02
- **Author:** Octav Team — Portfolio Intelligence for Digital Assets
- **Topic:** NAV Reporting
- **Tags:** security, compliance, vendor-review
- **Source:** Octav, Practical guides on crypto NAV reporting, multi-chain portfolio management and digital asset APIs, from the team behind Octav.

---
Connecting a fund's wallets to a third-party portfolio provider is a vendor risk
decision before it is a product decision. These are the questions a security
review should ask, and what good answers look like.

> **Disclosure:** we are one such vendor. The questions below are the ones we
> get asked, and they are the right ones to ask us too.

## 1. Do you ever hold private keys?

The only acceptable answer is no.

Portfolio tracking reads public chain data. It requires an address, not a key,
and a provider asking for signing authority is asking for far more access than
the job needs. Octav is read-only and never requests private keys.

This matters more than it sounds: a read-only integration cannot move funds even
if the vendor is fully compromised. That single property removes most of the
tail risk from the relationship.

## 2. What is the authentication model?

Octav Pro uses magic-link email authentication — no password to be reused,
leaked or phished from a password database that should not have existed.

Ask what happens on account compromise. With read-only access and no key
custody, the blast radius is disclosure of which addresses you track, not loss
of funds. That is a real concern for a fund that treats its positions as
confidential, but it is a different order of problem.

## 3. Are you SOC 2 audited, and which type?

The distinction matters and is frequently blurred:

| | What it means |
| --- | --- |
| **Type 1** | Controls are appropriately *designed* at a point in time |
| **Type 2** | Controls *operated effectively* over a period, typically 6–12 months |

Type 2 is the stronger assurance because it tests whether the controls actually
ran, not just whether they exist on paper. Octav is SOC 2 Type 1 and Type 2
compliant; evidence is at [trust.octav.fi](https://trust.octav.fi). The
distinction is worth understanding properly —
[What SOC 2 Type 2 Means for Portfolio Data](/soc2-type-2-certified).

Ask for the report, not the badge. A logo on a marketing page is not an audit.

## 4. What data do you retain, and where?

Specific questions worth asking any provider:

- Which addresses are stored, and for how long?
- Is portfolio history retained after an account closes?
- Where is data hosted, and does that satisfy your jurisdiction?
- Who internally can see customer address lists?

For a fund, the address list *is* the sensitive asset. Positions are public
on-chain, but the mapping from "these addresses belong to this fund" usually is
not, and that mapping is exactly what a portfolio provider holds.

## 5. What happens if you disappear?

Vendor continuity is part of the review, particularly for anything feeding
regulated reporting:

- Can portfolio history be exported in full?
- Is the data in a format usable without the vendor?
- What are the notice terms?

This is a real argument for keeping [daily
snapshots](/daily-crypto-portfolio-snapshots) exportable rather than trapped in
a UI. History you cannot extract is history you do not own.

## 6. Does the data support your audit obligations?

A security review and an audit review overlap here. If the provider feeds NAV,
the auditor will want reproducibility — the same query returning the same answer
months later. That is a data-architecture property, not a security one, but it
gets discovered during vendor review. See
[What Is NAV Reporting for Crypto Funds?](/what-is-crypto-nav-reporting) and
[Crypto Transaction Reconciliation for Audits](/crypto-transaction-reconciliation).

## The short checklist

1. Read-only, no private keys — non-negotiable.
2. SOC 2 Type 2, with the report available.
3. Clear retention and residency answers.
4. Full export of your own history.
5. Reproducible historical data if it feeds reporting.

A provider that answers all six well is a reasonable risk. One that treats these
questions as friction is telling you something.