Infrastructure and network security
Port hosts its infrastructure on Amazon Web Services (AWS). This page describes the architecture, network controls, and recovery processes that protect your service.
Architecture overview
The diagram shows Port's cloud-hosted infrastructure, the components you host yourself, and the third-party services you connect. It also shows the protocol for each connection.
You can choose between separate US and EU tenants:
| Tenant | AWS region | Port application | Port API |
|---|---|---|---|
| US | us-east-1 | https://app.us.port.io | https://api.us.port.io |
| EU | eu-west-1 | https://app.port.io | https://api.port.io |
AWS CloudFront exposes the Port application globally through a content delivery network (CDN). Port's API gateway uses commercial Traefik software hosted in Port's cloud network, exposed through an AWS Application Load Balancer (ALB).
All resources, including databases, Kafka, and Amazon Elastic Kubernetes Service (EKS), span multiple availability zones (AZs). The environment is multi-tenant: accounts share backend infrastructure, including database services and microservices, with complete logical segregation, role-based access control (RBAC), and token separation.
Amazon Relational Database Service (RDS), MongoDB, Kafka, and all other backends use a Port-managed AWS Key Management Service (KMS) key for AES-256 encryption. See data encryption for encryption details and data segregation for account-level database isolation.
Physical access control
AWS data centers use physical security and access controls, including:
- Alarms.
- Recorded closed-circuit television (CCTV) footage from server rooms.
- Perimeter fencing.
- Intrusion detection systems.
- Biometrics and multi-factor authentication.
Port employees do not have physical access to AWS data centers, servers, network equipment, or storage.
Logical access control
Port is the sole administrator of its AWS infrastructure. Only designated, authorized Port operations team members can configure it, on an as-needed basis, through a virtual private network (VPN) protected by multi-factor authentication.
Port uses a separate VPN for each environment and completely segregates test, staging, and production environments.
Intrusion detection
Port uses Amazon GuardDuty as its intrusion detection system (IDS). GuardDuty uses signature-based and algorithm-based detection to identify traffic patterns similar to known attack methods.
Rate limiting and traffic control
Port uses AWS WAF as its web application firewall, in addition to AWS's built-in denial-of-service (DoS) and distributed denial-of-service (DDoS) protections.
AWS WAF protects against known bot attacks and uses custom rules to enforce rate limiting and control unwanted traffic.
Business continuity and disaster recovery
High availability
Port uses redundant, appropriately provisioned servers throughout the service, including multiple load balancers, web servers, and replica databases. This redundancy maintains availability if a server fails. Port can also take servers out of operation for regular maintenance without affecting availability.
Business continuity
Port maintains a formal business continuity plan (BCP) for extended service outages caused by unforeseen or unavoidable disasters. The plan aims to restore services as broadly as possible within a reasonable time frame.
Port documents disaster recovery policies and procedures for recovering or continuing vital technology infrastructure and systems. You can request Port's BCP policy.
Disaster recovery
Port maintains encrypted backups in multiple AWS regions in accordance with its recovery point objectives. For a region-wide outage, Port has a documented protocol to deploy a duplicate environment in another AWS region.
The Port operations team performs an annual disaster recovery (DR) simulation to keep the process current with changes to Port.