Trust and security
This page is for the person who reviews Portward’s security for your company. It covers what runs in your cloud and what runs on portward.ai, what portward.ai holds, and how to report a vulnerability.
What runs where
Section titled “What runs where”The Portward gateway runs in your own cloud account or on your own server, in the network that can reach your databases. Its settings, your saved connections and its record of every answer stay there. On portward.ai we run signup, license keys, the account page, billing, the image registry and the relay.
The relay gives your gateway a web address without opening any inbound ports. It passes each visitor’s encrypted connection through to your server without decrypting it, so your query results cross the relay only in that encrypted form. If you point your own address at your server instead, people and AI apps reach your server directly and their traffic does not pass through portward.ai. If you connect the gateway through a Cloudflare Tunnel, traffic passes through Cloudflare, which ends the encryption and so sees the gateway’s answers and the values people reveal.
The egress report
Section titled “The egress report”scripts/e2e_egress.sh installs the gateway on a closed network whose only way out is a recording proxy, follows the install guide, and asks one question of a test database.
The report, scripts/egress_report.py, then matches every request that left to the line of code that sent it, and searches each request it can read for the test database’s names and values and for the install’s secrets.
It fails when a request matches no known code, when a value or secret goes where it must not, or when a line of the gateway’s code that opens a connection is missing from its list.
For connections through the relay, which it can’t read, it checks that the encryption ends on your server.
In the run on 2026-10-27, none of the test database’s names or values appeared in the 74 requests it could read, and no secret went anywhere it does not belong.
That run was of gateway build 88e1b8d.
Gateway changes made since then, including portward update and automatic updates, have not been through a run yet.
What portward.ai holds
Section titled “What portward.ai holds”For customers who sign up, we keep what we need to run the account and license in one database on portward.ai, and nothing from your data sources. A customer we give access by hand, without signup, is recorded in our cloud account’s access settings instead. For the relay that is its name, a hash of its relay token and any of its own domains, and the relay server keeps a copy of them. For the image registry it is its name with either its cloud account number or a pull-only key. The personal data in it is email addresses, company names typed at signup, IP addresses in its audit log, and the reason a customer gives when extending a trial. It holds no passwords or card numbers, and it keeps license keys only as hashes. What portward.ai stores lists every table and column, which ones hold personal data, and how long each is kept. That page covers the database and does not yet list what the logs on portward.ai keep, which are the relay’s logs, the control plane’s logs and the uptime check’s log. The control plane’s logs keep the IP address and web address of failed requests, with link tokens removed, and the IP address of refused billing events. The uptime check’s log keeps each failed check of signup.portward.ai and its reason for 14 days.
Our list of subprocessors is in review, and until it is published security@portward.ai sends it on request.
Report a vulnerability
Section titled “Report a vulnerability”Email the details to security@portward.ai. Please keep them out of public issues and pull requests. Our disclosure policy is still being written.