Security practices
Port's Chief Technology Officer manages security, and Port's Security & DevOps team maintains it. This page describes the development practices, organizational policies, and incident processes that protect your data.
Secure application development
Port practices continuous delivery: teams commit, test, ship, and iterate on code changes in rapid succession. Pull requests, continuous integration, and automated error tracking help reduce security issues and improve response and remediation times.
You can find release notes and details in the changelog.
Vulnerability remediation
Port scans code dependencies and containers to detect and remediate vulnerabilities in its libraries and packages. Port also uses static application security testing (SAST) to detect and remediate vulnerabilities in its source code.
Port handles vulnerabilities according to severity:
| Severity | Remediation timeline |
|---|---|
| Critical | Up to 2 days. |
| High | Up to 7 days. |
| Medium | Up to 45 days. |
| Low | Up to 90 days. |
Penetration testing
An independent third-party agency performs annual penetration testing. Port provides an isolated environment and a high-level architecture diagram; the agency has no access to customer data through these tests.
Port uses successfully exploited vulnerabilities to set mitigation and remediation priorities. You can request a summary of penetration test findings.
Vulnerability disclosure
You can report a vulnerability or security concern to security@getport.io. Include:
- A proof of concept.
- A list of tools used, including versions.
- The tools' output.
Port takes all disclosures seriously, promptly verifies reported vulnerabilities, and takes the steps needed to fix them.
Corporate security
Malware protection
Port enrolls all company-provided workstations in endpoint detection and response (EDR) solutions to protect against internal threats and local vulnerabilities. These solutions enforce security settings, including full-disk encryption and operating system updates.
Security policies
Port updates its security policies on an ongoing basis and reviews them annually for gaps. Enterprise customers can request an overview of the following policies:
- Access management.
- Backup management.
- Change management.
- Data retention management.
- Information security.
- Incident response.
- Risk management.
- Vulnerability management.
- Business continuity and disaster recovery.
Security training
All new employees receive onboarding and systems training covering environment and permissions setup, formal software development training where relevant, security policies, company policies, corporate values, and ethics.
All employees also complete security training at least annually. Port reviews the policies presented during onboarding once a year.
Disclosure policy
Port notifies customers of data breaches as soon as possible through email and their primary contact channel. Port then provides multiple updates throughout each day covering progress and impact.
Enterprise plans include a dedicated customer success manager responsible for customer communication, regular check-ins, and escalations.
Port reports operational uptime, issues, and known incidents on its status page. You can subscribe to email updates there.