Fuel cards on Hancock Street, disability claims on a Portland campus, vet lab analyzers built in Westbrook.
Greater Portland's corporate employers sell to customers far outside Maine. One processes fleet fuel and payment cards, another runs a disability and benefits campus here, and a third ships diagnostic analyzers to veterinary practices. Maine's 30-day breach deadline still applies to the residents in their files.
- Secrets & Certificate LifecycleCybersecurity
- Customer Identity (CIAM)Cybersecurity
- API IntegrationApplication Services
- Insurance PlatformsEnterprise Platforms
- Data Governance & AccessData & Analytics
- IoT PlatformsInternet of Things
- Machine & Workload IdentityCybersecurity
In Greater Portland we work with payments companies, insurers and diagnostics manufacturers.
The work includes customer and partner identity for card and payments platforms, secrets management for merchant and partner APIs, claims data governance for insurers under Maine's insurance data security act, and device identity for connected lab instruments. Cohash is headquartered in Frisco, Texas, serves Portland remotely and travels in for workshops and launches.
Cohash has no office in Maine. Our team works with Portland organizations remotely from Frisco, Texas, and travels to Maine for discovery workshops, design sessions and launch support.
- rules
- Maine breach notice, 10 M.R.S. §1348Maine Insurance Data Security Act, 24-A M.R.S. ch. 24-B
What's specific about Portland, Maine
Each figure comes from a public source, linked on the card.
Education and health services held 64.6 thousand of the Portland-South Portland metro's 305.2 thousand nonfarm jobs in September 2026 (preliminary), with 17.7 thousand in financial activities, according to BLS.
source ↗ 02WEX's 2025 Form 10-K places its global headquarters and principal executive offices at 1 Hancock Street in Portland under a lease running through 2034, with WEX Bank's industrial banking operations in Utah.
source ↗ 03IDEXX Laboratories keeps its worldwide headquarters in Westbrook, where its 2025 Form 10-K says it does manufacturing, research and development, marketing and sales work.
source ↗ 04Unum Group's 2025 Form 10-K lists Portland, Maine among five owned office campuses as of 31 December 2025, alongside Chattanooga, Columbia, Baton Rouge and Dorking in the UK.
source ↗ 05Maine's comprehensive privacy bill, LD 1822, failed on a final vote in the Legislature in April 2026, WAGM reported, leaving the state without a consumer privacy law of that kind.
source ↗Who we work with in Portland, Maine, and the rules they work under
-
Fleet cards and payments
Fleet and corporate payment platforms connect fuel merchants, fleet managers, drivers, travel suppliers and banking partners, and each connection uses an API key, certificate or file transfer account. Drivers often sign in from a phone. We put partner credentials into a vault with rotation, design customer identity for fleet admins and drivers, and scope access to cardholder data.
-
Disability, life and benefits insurance
Claims files mix medical records, payroll data and employer feeds, and examiners, nurses and vendors all need some slice of them. We build role-based access to claims data, review vendor and employer portal accounts, and set up the logging that lets you answer a superintendent's questions inside the act's three-business-day window.
-
Veterinary diagnostics and connected instruments
In-clinic analyzers and reference lab systems send results to cloud software used by veterinary practices. Every analyzer is a device identity, and every practice is a customer tenant. We design certificate-based device identity, tenant isolation in the cloud platform and governance for the clinical data used to train diagnostic models.
-
Maine breach notice, 10 M.R.S. §1348 ↗
Notice goes to residents as expediently as possible and within 30 days of learning of the breach and identifying its scope. The business also notifies its regulator within the Department of Professional and Financial Regulation, or the Attorney General, and the consumer reporting agencies when more than 1,000 people are notified at once.
-
Maine Insurance Data Security Act, 24-A M.R.S. ch. 24-B ↗
Section 2266 requires licensees to notify the Superintendent of Insurance as promptly as possible and within three business days after determining a cybersecurity event, where Maine is the home state or 250 or more Maine consumers are involved and other criteria are met.
Most requested in Portland, Maine
The services clients in Portland, Maine ask us for most.
01Does Maine have a consumer privacy law like Connecticut's?
Not yet. The comprehensive privacy bill, LD 1822, failed on its final vote in April 2026. Maine's breach statute and its insurance data security act still apply, and if you hold data on residents of New Hampshire, Connecticut or other states with privacy laws, their rules apply to that data.
02How strict is Maine's 30-day breach deadline in practice?
The clock starts once you are aware of the breach and have identified its scope, so the time spent scoping counts for a lot. Clear sign-in and data access logs let you scope in days instead of weeks. A law enforcement delay is limited to 7 business days after police say notice will not compromise their investigation.
03Can you help with PCI DSS identity requirements for a payments platform?
Yes, on the identity side. Unique IDs, multifactor authentication into the cardholder data environment, access reviews and service account control line up with PCI DSS requirements 7 and 8. We do not act as a QSA or sign your report on compliance.
04Our analyzers ship with a shared admin password. How do we fix that across the installed base?
Usually with per-device credentials issued at provisioning or on the next software update, plus a certificate the cloud platform checks before accepting results. Older units can sit behind a clinic gateway that holds the credential for them until they are replaced.
1325019f - 01BLS, Portland-South Portland economy at a glancebls.gov ↗
- 02WEX, 2025 Form 10-Ksec.gov ↗
- 03IDEXX Laboratories, 2025 Form 10-Ksec.gov ↗
- 04Unum Group, 2025 Form 10-Ksec.gov ↗
- 05WAGM, Maine data privacy bill fails final vote (April 2026)wagmtv.com ↗
- 0610 M.R.S. §1348legislature.maine.gov ↗
- 0724-A M.R.S. §2266legislature.maine.gov ↗
- 08PCI Security Standards Council document librarypcisecuritystandards.org ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it