Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · portland

A Hillsboro fab, a Beaverton sneaker app and a hospital on Marquam Hill all answer to Oregon's privacy act.

Intel calls itself Oregon's biggest employer, and OHSU says the same of Portland. Around them sit apparel and outdoor brands with large app audiences, a federal power marketer and a busy port. Oregon's Consumer Privacy Act has applied since July 2024, and its opt-out signal rule took effect in January 2026.

Talk to an engineer
work in portland, oregon6 services
2 local rules covered below
in short·15-second read

Around Portland we work with semiconductor manufacturers, athletic and outdoor brands, health systems and energy organizations.

Fabs need privileged access controls for tool and process networks. Consumer brands need customer identity and consent that honors Oregon's privacy act, including opt-out signals. Hospitals need governed clinical and research data. Cohash is based in Frisco, Texas, supports Portland organizations remotely and travels in for workshops and launches.

We don't have a Portland office. Cohash is headquartered in Frisco, Texas, works with Oregon and southwest Washington organizations remotely, and flies in for discovery workshops, fab or plant visits and launches.

Ask an engineer facts checked 2026-10-21 · 7 sources
rules
Oregon breach notification, ORS 646A.604Oregon Consumer Privacy Act, ORS 646A.570 to 646A.589
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
portland, oregon by the numbers

What's specific about Portland, Oregon

Each figure comes from a public source, linked on the card.

01 1,222

Manufacturing holds about 111.9 thousand of the 1,222.1 thousand nonfarm jobs in the Portland-Vancouver-Hillsboro metro, with education and health services at 212.6 thousand, per BLS data for September 2026 (preliminary).

source ↗ 02 $16.8 billion

Intel describes itself as Oregon's biggest employer and puts its annual economic impact in the state at $16.8 billion, based on 2023 data.

source ↗ 03

Oregon Health & Science University calls itself Portland's biggest employer and runs hospitals and clinics across Oregon and southwest Washington.

source ↗ 04 15,000

The Bonneville Power Administration markets about one-third of the electric power generated in the Northwest, from 31 federal hydroelectric projects, over about 15,000 miles of high-voltage transmission facilities.

source ↗
who and what

Who we work with in Portland, Oregon, and the rules they work under

industries

  1. Semiconductor fabs and equipment suppliers

    Tool networks, equipment vendors' remote support links and MES systems all need tightly held access. We put vendor remote sessions behind PAM with approval and recording, segment tool networks by identity, and govern the engineering accounts that reach recipe and yield data.

  2. Athletic and outdoor brands

    Member apps, loyalty programs and limited product drops bring millions of customer accounts and constant bot traffic. We build customer identity with passkeys and bot defense, plus a consent layer that honors Global Privacy Control and Oregon's limits on targeted ads for consumers under 16.

  3. Hospitals and academic medicine

    An academic system combines clinical care, research and teaching across many sites. We tie research data access to protocol approval, resident and student access to rotation dates, and keep audit trails that the privacy office can query without a ticket to IT.

  4. Hydropower and transmission

    Power marketers and utilities run control systems under federal reliability standards with strict rules on who reaches them. We focus on privileged and remote access to operational networks and on the records that show who connected to which system and when.

regulations

  1. Oregon breach notification, ORS 646A.604 ↗

    Covered entities notify Oregon consumers without undue delay and no later than 45 days after discovering a breach. If more than 250 consumers are affected, the Attorney General gets notice too. A vendor must tell the covered entity within 10 days of discovering a breach.

  2. Oregon Consumer Privacy Act, ORS 646A.570 to 646A.589 ↗

    In effect since 1 July 2024 for businesses meeting its data-volume thresholds, and for all auto manufacturers regardless of size. From 1 January 2026 businesses must honor opt-out preference signals such as Global Privacy Control, and data on consumers under 16 can't be used for targeted ads without permission.

services

Most requested in Portland, Oregon

The services clients in Portland, Oregon ask us for most.

you are herePortland, Oregon
01How do we honor Global Privacy Control under Oregon's law?

Detect the signal in the browser or app, treat it as an opt-out of sale and targeted advertising for that consumer, and pass the choice to your tag manager, ad platforms and customer data platform. We build that flow and the logs that show the opt-out took effect downstream.

02Can equipment vendors keep remote access to our fab tools?

Usually they need it, so the goal is control. Each vendor session goes through a PAM gateway with approval from your equipment engineer, a time limit and recording. Persistent VPN tunnels and shared vendor accounts are what we remove first.

03How fast must we notify Oregon consumers after a breach?

No later than 45 days after discovery, and sooner if you can. Notify the Attorney General as well when more than 250 consumers are affected. If you hold data for another company, tell them within 10 days. Counsel handles the notices, and we reconstruct the access timeline they need.

04Do Oregon's under-16 rules affect a loyalty program?

They can if the program knows or willfully disregards that a member is under 16 and uses the data for targeted ads or certain profiling. We add age signals to the identity profile and route those members to a consent path, with counsel setting the policy.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers ChicagoTrading & healthcare New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 7 sources linked last checked 2026-10-21 content fingerprint 992eceb6
  1. 01BLS, Portland-Vancouver-Hillsboro economy at a glancebls.gov ↗
  2. 02Intel in Oregonintel.com ↗
  3. 03OHSU, aboutohsu.edu ↗
  4. 04Bonneville Power Administration, who we arebpa.gov ↗
  5. 05ORS chapter 646A (Oregon Legislature)oregonlegislature.gov ↗
  6. 06ORS 646A.604 text (Oregon Public Law mirror)oregon.public.law ↗
  7. 07Oregon DOJ, Consumer Privacy Actdoj.state.or.us ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it