Data security and privacy

This page describes how Port protects and manages your data, from encryption and account isolation to retention, deletion, and secret storage.

Data encryption

Port encrypts all data on its servers at rest using AES-256 encryption. AWS stores and manages encryption keys in its redundant, globally distributed Key Management Service. Access to physical storage devices alone does not allow an intruder to decrypt the data without the keys.

Encryption at rest also protects data during backups and infrastructure management. Port sends data exclusively over HTTPS connections encrypted with Transport Layer Security (TLS), enforcing TLS 1.2 or later wherever applicable.

Data segregation

Each Port account has a dedicated database. Access requires a token generated from that account's API credentials, and the token grants permissions only to that account's database.

Port never transfers or stores customer data on employee machines or devices.

Data retention

You manage the data you ingest into Port. The following retention periods apply:

Data	Retention period
Data you ingest	Indefinitely, unless you delete it.
Audit logs tracking catalog, data model, action, automation, and configuration changes	90 days by default.
Sign-in and account access logs	30 days.

Data removal

When you terminate your contract or request deletion of your account and its data, Port deletes the account and its associated data. This includes blueprints, entities, actions, automations, runs, users, and teams. The data immediately becomes inaccessible to you.

Port retains the data in backups for 14 days. After 14 days, Port also removes it from backups, and you can no longer retrieve it.

You can also delete data through Port's REST API or the Port application, or request deletion.

Handling PII

Port stores infrastructure metadata. The only personally identifiable information (PII) Port requires for its operation is:

• First name.
• Last name.
• Email address.

Port uses this information only to authenticate users and sign them in.

Secret storage and handling

You can use Port without sharing or storing secrets with it. Port offers optional secret storage for convenience and specific features or use cases. You can implement those use cases through alternatives that do not require sharing secrets with Port.

Port encrypts all shared secrets at rest and in transit. After you save a secret, you cannot retrieve its value directly; Port only uses and references it as you specify. Port isolates each customer's secrets at both the data storage and access permissions layers.