A smaller data footprint. Clearer control.
Gong credentials stay out of persistent storage. Preview files are isolated and expire after three days. Paid Gong exports go to your S3; scoped Chorus migrations go to your Azure Blob.
Credential handling
Gong previews use a revocable API key and secret. Paid exports also use least-privilege access to the S3 bucket you choose.
Credentials travel to our API over TLS 1.2 or higher.
The worker holds credentials in memory for the run. They are not written to disk, logs, or a database.
The run context is released when the job finishes. Credentials are not copied into persistent application state.
Gong access is read-only. The S3 role needs write and failed-upload cleanup access only to the bucket or prefix you authorize.
Chorus operator workflow
Chorus migrations are scoped and run by an operator. We agree on a temporary access handoff first; this form and regular email are not used to collect credentials.
Only after fit and price are confirmed do we request a revocable Chorus token and short-lived Azure access.
The operator runs the approved export and delivers available recordings, call metadata, and a completion manifest to your container.
The operator removes the local working copy after delivery and asks you to revoke the Chorus token.
Gong preview: credentials stay out; sample files expire.
Each free Gong preview uses a private Cloudflare R2 bucket for three selected calls and a dedicated Durable Object for authorization and findings. Access ends after three days; alarm retries and an R2 lifecycle rule backstop deletion. Paid Gong files stream to your S3.
- Job metadata: start time, status, file count, byte count
- Export progress: which recording IDs have been processed
- HMAC-SHA-256 of your IP address for rate limiting
- Your account identity, trial status, content-free findings, and purchase events
- Gong API access keys or secrets
- S3 destination credentials
- Raw call inventory in Postgres
- Trial recordings, transcripts, or Gong metadata after the three-day deadline
- Participant data in analytics or funnel events
Gong product: encryption in transit and at rest
All communication between portshift and external services uses TLS 1.2 or higher. This covers:
- Browser → portshift API
- Worker → Gong API (inventory and recording download)
- Worker → Cloudflare R2 trial storage / customer S3 destination
- Worker → portshift database (job state)
Certificate validation is enforced. We do not permit self-signed certificates in any production path.
Trial artifacts are encrypted at rest in private Cloudflare R2. Paid export data lives in your S3 under your account's policies:
- Amazon S3: SSE-S3 or SSE-KMS with your KMS key
- Cloudflare R2: encrypted private trial storage with a three-day deletion policy
portshift's own database (Neon Postgres) is encrypted at rest by the cloud provider.
Gong service infrastructure and isolation
The self-serve Gong product uses managed Cloudflare Containers without a persistent application filesystem. A container can process more than one bounded run, so isolation is enforced by per-run credential closures, per-job database leases and manifests, per-trial buckets and Durable Objects, and customer-specific destinations.
Containers can be stopped and replaced by the platform. Portshift does not use local disk as durable customer storage.
Every run gets its own source and destination adapters, in-memory credentials, execution lease, and manifest scope. Credentials are never placed in module-global state.
Production services use encrypted provider infrastructure and explicit customer isolation. Destination residency is governed by the S3 region you choose.
Integrity tracking
Gong export runs track each artifact's state, destination path, byte count, and SHA-256 digest in PortShift's database. The current export does not include a customer-readable manifest in the destination.
- SHA-256 hash of every exported file
- Gong call ID, artifact kind, and destination path
- Per-artifact status, attempts, and verified timestamp
- Job-level file and byte counters
The run record is internal to PortShift. It is not an independent, customer-verifiable compliance archive.
Customer-readable manifest: not includedWhat we're working on
Engage an independent third party to test the API surface, credential handling pipeline, and storage integration layer before making any recurring-test commitment.
Documented IR runbooks, 24-hour breach notification SLA to affected customers, and a public security advisory page.
Bring-your-own-key encryption for the job metadata stored in portshift's database, for customers who require full key ownership.
Responsible disclosure
Report security issues tosecurity@portshift.app. Include the affected URL, reproduction steps, and potential impact. We will triage and respond as soon as practical.