Portrait Analytics

The workflow case has strengthened. Portrait is still the vendor in our coverage designed most closely around how a fundamental long/short analyst works, and 2026 has filled in what was missing. Easel now builds models, memos and IC briefs, Mosaic runs a firm's framework across a whole universe and ranks the results, and an MCP server, CLI and iOS app extend delivery. Persistent thesis monitoring remains the most developed in the cohort.

The platform evidence has caught up only in part. Portrait now states an annual SOC 2 Type 2 examination and annual third-party penetration testing, a meaningful step for a company of its size. What remains open: we did not locate a no-training commitment, SSO, private-cloud deployment or a subprocessor list, and no priced financing has been disclosed since July 2023. A change of chief executive was reported in July 2026 without a company announcement.

We lower the rating to Emerging, at 6.38, with an Improving outlook. This Rating Review applies the full sub-criteria standard used for every company covered since October and replaces the 7.05 published on 20 October. Under that standard, controls and disclosures not located publicly score low until documented, and company-reported traction does not lift a score. The largest move is in Enterprise Readiness, now 4.93: the master services agreement permits use of customer data to improve the service, and SSO, MNPI controls and private deployment were not located. AI & Technology, now 6.08, reflects unnamed model providers and no published evaluation. Product Capability, at 7.58, and Workflow Fit, at 7.50, remain its strongest dimensions; in our assessment it is still the closest design fit to the fundamental long/short analyst in our coverage. We located no material news since September; the position moves from Established Solutions to Emerging.

Strengths

• Buy-side native design. The product follows the analyst's own sequence — find the idea, frame the debate, monitor the position — and was built by investors from Baupost, Citadel and Millennium.
• Persistent thesis monitoring. Thesis, datapoint and event monitors test a named position continuously against new filings, transcripts and news.
• Universe-scale ranking. Mosaic applies quantitative gates, writes a qualitative dossier on each company and ranks the universe against the firm's own framework.
• Audited security posture. The security page states an annual SOC 2 Type 2 examination covering the Security category and annual independent penetration testing, with a detailed control description (AWS KMS, Security Hub, environment separation in Auth0 and AWS).
• Agent-ready delivery. An OAuth MCP server for Claude and ChatGPT, a CLI, a Partner API and Slack, Teams and email delivery let research reach analysts in the tools they already use.
• Documentation discipline. Public documentation carries review dates, explicit entitlement rules and a documented credits model — unusually transparent for the category.
• Low-friction evaluation. A one-week firm trial, an email-only trial of Easel and a paid Mosaic trial of up to 20 companies make it easy to test against live coverage.

Cautions

• Leadership continuity. A July 2026 interview describes Eric Moster as chief executive; David Plon held the role through at least February 2026 and his current role is not stated publicly.
• Funding and scale. No priced financing has been disclosed since the $7m seed in July 2023, and headcount is reported at 13–19.
• Data governance. We did not locate a commitment that client data is not used for model training; the master services agreement allows customer data to be used to create service data that improves the product.
• Enterprise controls. SSO/SAML, private-cloud or single-tenant deployment, data-residency choice and a trust centre were not located.
• Content entitlements. Visible Alpha depth and Third Bridge access depend on the firm's own agreements with each provider, and broker research is not offered.
• Cost predictability. Pricing is not published.
• Contract protections. The master services agreement offers commercially reasonable efforts without an SLA, and caps liability at twelve months' fees outside security and data-use breaches.
• Evaluation evidence. No benchmark or independent accuracy measurement has been published, and no customer is named publicly.