Announcing SOC2 Compliance: ensuring your internal developer portal is as safe as it should be

A recent security vulnerability discovery raised the question of internal developer portal security. Can a developer portal be both SaaS, not self-hosted, and be designed with security first and foremost? In short, the answer is “Yes!!”.

We’re happy to announce that we’ve passed SOC2 certification and are now SOC2 compliant. 

Some of the key highlights in our secure approach to internal developer portals are as follows:

1. Port does not store its customers’ credentials. The data ingested to Port is in push; Port does not collect any data on its own.
2. Port’s web interface is the main way to view, organize and manage the Software Catalog. It is highly customizable and gives the customer complete control over what catalog data is exposed and to whom.
3. Changes are tracked in two ways, either through a secure webhook or through a subscription to a dedicated message queue. In addition, Port offers a custom agent which customers can install to handle changes, self-service actions and other notifications. The agent will handle parsing the requests and forwarding them to the customer’s infrastructure, saving the need to validate the authenticity of the request.
4. All data managed by Port is encrypted at rest & in transit. Port uses SSL (TLS v1.2+ where applicable) for all of its requests and implements industry standard encryption, authorization and authentication. It also uses rotating access tokens, credentials and secrets to guarantee the long-term safety of user data
5. We offer industry-standard data controls for data security. These include encryption-at-transit, encryption-at-rest, and PII data redaction. Port also employs Single Sign-On (SSO), Role-Based Access Control (RBAC), and audit logs to secure access to its platform and prevent access to unauthorized data.