Get started

For the person who sets up Portward at your company. These steps take you from signing up to your first answer in Claude or ChatGPT. You run the gateway in your cloud account or on a server of your own. Your databases and the answer records stay there, and Portward keeps no copy of your data. Claude or ChatGPT sees only what your rules allow. If you use the Portward relay, your traffic passes through it encrypted. The TLS certificate and its private key stay on your gateway.

You need:

• an email address at your company’s own domain
• admin access to your company directory: Microsoft Entra ID, Okta, Google Workspace or another OpenID Connect directory
• an AWS, Azure or Google Cloud account, or a Linux server with Docker
• a read-only login for a database you want to ask about

1. Sign up

One license covers your whole company. If someone at your company may have signed up already, ask them for the key before you sign up. If you aren’t sure, sign up anyway: the email tells you whether your company already has a license.

Open signup.portward.ai/signup. The form runs a short robot check when the page opens. Email me a link works once the form shows “Checked: you can send it.” If it says “The check didn’t finish: reload the page.”, reload it. Enter your work email and your company’s name, then select Email me a link. Personal addresses such as gmail.com can’t start a trial. Your gateway’s address shows on the key page, after step 2. The page right after the form doesn’t show it yet.

The next page says “Check your email” and “If that address can start a trial, a link is on its way.” It reads the same whether or not a trial can start. Look in your inbox either way: step 2 says what each email means.

Your gateway’s address comes from your email’s domain. For acme.com it is https://acme.gw.portward.ai. If that name is taken or reserved, signup uses your whole domain with dashes for dots, such as acme-com. If that is taken too, it picks a random name. Signup’s reserved names include app, mail, support and portward. Whatever the name, the key page shows the exact address, and your license key always carries the same name: pwlic_acme_... for acme.gw.portward.ai.

2. Confirm your email and copy the key

The email comes from signup@portward.ai. When a trial can start, its subject is “Confirm your Portward trial” and it holds a link that works once, within 30 minutes. The link opens a page headed Confirm your trial. Select Show my license key there. The same page then shows Your license key. This page is the key page. If the link has expired, sign up again. If you signed up more than once, go by the newest email. Your mail app may group the emails into one conversation; open the last one in it, at the bottom of the conversation. If it looks empty, expand it (Gmail hides repeated text behind •••).

If the subject is “Your company already has a Portward license” instead, someone at your company signed up before you, and this signup doesn’t give you a key. The email names neither your gateway’s address nor who holds the license. Then:

1. Ask whoever set Portward up for the key.
2. If you don’t know who that is, enter your own address at signup.portward.ai/reissue. It only sends an email, and only if your address holds the license. That email names the gateway’s address. Nothing is replaced until you open its link and select Replace it and show the new key.
3. If no email comes, write to support@portward.ai from your work address and ask who holds the license (Support says what to send).

Replace the key only if no running gateway needs it, because the old key then stops working everywhere it is used. To see whether a gateway runs, open its address followed by /health, such as https://acme.gw.portward.ai/health. If it answers {"ok": true, ...}, a gateway uses the key.

The key page shows:

• Your license key, which starts with pwlic_. It is shown once. Copy it with its Copy button into your password manager before you leave the page.
• Your gateway’s address.
• The redirect address for your sign-in app, which you need in step 5.
• A Deploy button for AWS, Azure and Google Cloud, which you use in step 6. The commands for your own server are under On your own server, at the bottom of the key page. Select it to open the section.

The license key is your company’s only Portward credential. The gateway uses it to download the Portward image and to connect to the Portward relay, which forwards the traffic for your gateway’s address. If you lose it, replace it.

3. Know your trial

The free trial lasts 14 days and covers up to 10 seats. The 14 days start when you install. That is the first time your gateway downloads the Portward image or connects through the Portward relay, whichever happens first. Signing up doesn’t start them.

A seat is one person who signed in to your gateway in the last 30 days. Your gateway counts them itself, and Portward never learns who signed in or how many. Going over the number of seats doesn’t lock anyone out.

When the trial ends, new downloads of the Portward image stop. A gateway that is already running keeps its address for 14 more days. After that, the address stops working. You can extend a trial once, by 14 days.

If signup asks you to choose seats

If signup asks you to choose seats, step 2 changes:

1. The link in the first email opens Confirm your subscription. Choose your admin seats and user seats. An admin seat is for someone who connects data and sets the rules, and it includes user access. A user seat is for someone who asks Claude or ChatGPT about company data. Where both are offered, also choose monthly or annual billing.
2. Select Continue to payment. Stripe’s checkout page asks for a card. You aren’t charged that day.
3. A second email, “Your Portward license is ready”, has a link that works once, within 30 minutes. It opens the same key page as above.

This trial also lasts 14 days from when you install, as above, and it covers the seats you chose. Three days before it ends, we email you what your card will be charged for the first month or year. If you don’t install within 30 days of checkout, the subscription ends and you pay nothing. We email you 3 days before that happens. Your account page at signup.portward.ai/account shows your plan and seats, and its Manage billing button opens Stripe, where you can cancel. To extend this kind of trial, email your reason to support@portward.ai.

4. Pick a cloud

The Roughly column is what your cloud provider bills each month for the resources the gateway creates. Portward’s own price is separate.

Where	What gets created	Roughly	Guide
AWS	One CloudFormation stack: the gateway on ECS Fargate, records on encrypted EFS, keys in Secrets Manager	$20 a month	Portward on AWS
Azure	One resource group: a small Linux VM, an encrypted records disk, a Key Vault and nightly backups	$14 a month	Portward on Azure
Google Cloud	One Terraform apply from Cloud Shell: a small VM, a records disk snapshotted daily, Secret Manager	$18 a month	Portward on Google Cloud
Your own server	Docker Compose on a Linux machine in the network that can reach your databases	Your server’s cost	Install on your own server

Each guide breaks its figure down by resource, at list prices in one region.

5. Register the sign-in app

People sign in to Portward with their work account. Register the app before you deploy, because each cloud’s form asks for its details. The key page numbers its own sections: this step is its section 1, Register the sign-in app in your directory.

In your directory, register one web app for the gateway. Its redirect address is your gateway’s address followed by /auth/callback. The key page shows it with a copy button. Keep these for the next step:

• the directory’s sign-in address (its issuer)
• the app’s client id and client secret
• the group whose members manage Portward (the admins)

The three directories we test against each need a few more settings, listed below. The key page sums these up. For any other directory, see Any other OpenID Connect directory. Microsoft Entra ID sends groups only once the app has a groups claim, and it sends group ids, so the admins group is the group’s Object ID (Microsoft Entra ID). Okta sends groups only when asked, so add a groups claim to the app and put groups in Extra scopes on AWS or Extra sign-in scopes on Google Cloud (Okta). Google Workspace sends no groups. With Google, name the admins by their sign-in id. To let your staff in, put @yourcompany.com in the users setting, which is the Other users parameter on AWS and users on Google Cloud and your own server (Google Workspace). The Azure form takes only an admin group, with no field for extra scopes or admin sign-in ids. On Azure, use Microsoft Entra ID or another directory that sends groups without extra scopes (Microsoft Entra ID).

Sign-in setup has the steps for Microsoft Entra ID, Okta, Google Workspace and other directories. On your own server, the init command under On your own server on the key page takes the issuer and the client id too, as --directory <issuer> --client-id <client id>. Add --admin-group "<group>" to make the admins group’s members admins, as Install on your own server shows. The client secret then goes in .env.

6. Deploy

The key page’s section 2, Deploy it in your cloud, has the buttons. Press your cloud’s Deploy button there. Each guide has the same button. Your cloud’s console opens in your own account with Portward’s template ready, and nothing is created until you confirm. Paste your license key into the License key field. The key is never part of the link. Fill in the sign-in app’s details from step 5.

When it’s done, open your gateway’s address followed by /health in a browser. It responds with "ok": true.

7. Make yourself the admin

1. In Claude or ChatGPT, add a custom connector with your gateway’s address followed by /admin/mcp. Use it in Claude and ChatGPT has the steps for each app and plan, and says which plans let you add both connectors.
2. Connect, and sign in with your work account. The first time, the gateway asks you to allow the app.

Members of the admins group, or the people you named as admins, are admins as soon as they sign in. On your own server without an admin group, you name the admins after your first sign-in: see Make yourself the admin.

8. Connect a source

1. Allow the database’s host name first. On AWS, add it to the stack’s Database hosts parameter, unless you entered it when you created the stack. On Google Cloud, add it to setup_hosts in your Terraform settings and run terraform apply. On your own server, add it to setup_hosts in the gateway’s portward.toml, then run docker compose restart gateway in the install folder. On Azure, do the same through Run command (Running it). Object stores, Microsoft 365 and Google Drive need no host.
2. In a new chat with the admin connector on, ask “Set up a connection in Portward.” If Claude asks which connection you mean, choose the one in Portward. Setup opens in the chat. Select Add a source if setup shows its list of sources. Claude may open the form for you with a kind it guessed, so check Kind of source and pick yours. Give the source a Name that people and the AI will see, such as sales. Enter the read-only login as your source’s page says, then select Test and save. What you type goes straight to your gateway and never through the AI. When the check passes, setup says “Connected. Nothing is exposed yet. Choose the access rules below and save.”
3. The next screen, Access rules, lists each table with a tick box and a row for each column. Tick the tables the AI may use. A table you don’t tick stays hidden. Every column starts as Real value, and setup marks the ones that look personal with “Suggested: …”. For each column, under Claude sees (ChatGPT sees in ChatGPT), pick Real value, Token (a stand-in it can still count and join on) or Totals and averages only. Setup lists each table by its name without the schema, such as invoices. For a Token column, keep the token type setup offers, such as EMAIL for email. With no suggestion, setup offers the column’s name in capitals, such as CUSTOMER. Keep People see as Real value. People then see real values in their own results table, and the AI sees tokens. Make every column that names the same person or company a Token, such as both customer and email. A real email in the answer would name the customer anyway. Totals and averages only leaves out any group of fewer than 5 rows. Leave the table’s other choices (what the AI may change, People may send to Claude, the AI saving its context) as they are for a first source. For example, for “How much is open per customer?” on an invoices table, set customer and email to Token and keep id, amount, status and issued_on as Real value. With amount as Totals and averages only, a customer with fewer than 5 invoices would be left out of the answer.
4. Select Save access rules. A change that gives more access asks you to sign in again in a new window and select Confirm and save on your gateway’s own page. Claude first asks whether to open the link. Select Open link. Nothing changes until you confirm. Then the top of setup says “Saved. Live now for questions: …”. Setup’s third step, Context, describes the data for the AI. You can do it later.

Connect a source lists each database and the permissions its login needs.

9. Ask a first question

Add the data connector, your gateway’s address followed by /mcp, the same way as the admin connector, and sign in. In a new chat with the data connector on, ask a question about the data you connected. The results table above the answer shows real values, and its footer shows the ID of its answer record. In the AI’s answer, values from Token columns show as tokens, such as CUSTOMER_1a2b3c4d5e6f7a8b, and the answer usually ends with the record IDs it relied on. If a word in your question could mean more than one thing, such as which invoices count as open, the AI says how it read it. The answer record keeps that reading.

Your team adds the same data connector. The user groups and users you set decide who may use it. You set them in the stack’s parameters on AWS, in your Terraform settings on Google Cloud, and in portward.toml on Azure and your own server. Each cloud guide’s last step has the details for that cloud. On some Claude and ChatGPT plans, an owner or admin adds the connector once for everyone: see Use it in Claude and ChatGPT.

10. Next: give groups access

Your first source is open to every data user. Before your team adds the data connector, decide who may use what:

1. Make your teams data users by group: People and groups.
2. Limit each dataset to the groups that need it, and preview what a group gets: Dataset access.
3. Check each column’s rules, and show more to the groups that need it: What people and the AI see.
4. Describe the data so answers use your definitions: Context and definitions.

Core concepts explains the words these pages use.

Replace a license key

Replace the key if you lose it or think someone else has it. Each way below makes a new key and shows it once. The old key stops downloading the Portward image at once. The relay stops letting gateways in with the old key within a minute. If the relay can’t reach Portward’s license service at that moment, it can take up to 10 minutes. Until then, a gateway still on the old key keeps answering, so put the new key in right away.

• Lost the key: open signup.portward.ai/reissue and enter the email address the license was issued to. The email’s link works once, within 30 minutes. Open it and select Replace it and show the new key.
• From your account page: sign in at signup.portward.ai/account with the email address the license was issued to, then select Rotate license key.
• With the current key: send it in a POST /v1/license/rotate request. The response holds the new key as license_key. The key goes in from a variable, so it never appears on the command line:

  read -rs PORTWARD_LICENSE && export PORTWARD_LICENSE   # paste the current key, then Enter
  printf 'Authorization: Bearer %s\n' "$PORTWARD_LICENSE" |
    curl -sS -X POST https://signup.portward.ai/v1/license/rotate -H @-

Then put the new key where your gateway keeps it, and start the gateway again so it reads the new key:

• AWS: Update stack, keep the template, and put the new key in License key. Then, in the ECS console, open the stack’s service, choose Update service, and select Force new deployment. Your gateway’s address stops answering as soon as you replace the key, and comes back 2 to 3 minutes after Force new deployment, so do the three steps together.
• Azure: put it in the Key Vault secret license-key, then run systemctl restart portward on the VM. See Running it.
• Google Cloud: set license_key to the new key, run terraform apply, then restart the VM. It reads the key when it starts.
• Your own server: in the install folder, log in to the registry with the new key, write it to relay.env if you use the relay, and recreate the containers. A plain docker compose restart keeps the old key.

  read -rs PORTWARD_LICENSE && export PORTWARD_LICENSE   # paste the new key, then Enter
  printf %s "$PORTWARD_LICENSE" | docker login registry.portward.ai -u portward --password-stdin
  [ -f relay.env ] && printf 'RELAY_TOKEN=%s\n' "$PORTWARD_LICENSE" > relay.env   # only with the relay
  docker compose up -d --force-recreate

  Then run doctor (Install, step 3): it ends with “All checks passed.” once the gateway answers at its address with the new key.

Extend a trial

You can extend a free trial once, by 14 days, after it has started. You can ask up to 14 days after it ends. The new end date is 14 days after the old end date, or 14 days after the day you ask if that is later. Send a short reason with your license key in a POST /v1/license/extend request:

read -rs PORTWARD_LICENSE && export PORTWARD_LICENSE   # paste the key, then Enter
printf 'Authorization: Bearer %s\n' "$PORTWARD_LICENSE" |
  curl -sS -X POST https://signup.portward.ai/v1/license/extend -H @- \
    -H 'Content-Type: application/json' -d '{"reason": "Waiting for a read-only database login"}'

Portward extends the trial at once. The response shows "extended": true and the new end date as expires_at, in Unix time. If the response says “only a started trial can be extended, once”, the trial hasn’t started yet, was already extended, or was bought through checkout.

You can also email your reason to support@portward.ai. That’s the way to extend a trial you started at checkout (If signup asks you to choose seats).

Help

Email support@portward.ai with what you were doing and what you saw. Never send your license key. The Support page lists what to include.