Designed to minimize data exposure
portshift moves sensitive data — call recordings, transcripts, API credentials. We minimize what is retained, keep credentials out of databases and logs, isolate every trial bucket, and send the paid export to storage you control.
Credential handling
The trial uses a revocable Gong API access key and secret. A paid export separately uses least-privilege access to the S3 bucket you choose. Here is exactly what we do with those credentials.
Credentials travel from your browser to our API over TLS 1.2+. They are never sent over unencrypted channels.
Credentials are loaded into the worker process memory when a job starts and are never written to disk, logs, or any database table.
When a run finishes — successfully or not — its credential-bearing request context is released. The managed container may be reused, but credentials are not copied into persistent application state.
Gong needs read access. The S3 role or key needs write and failed-upload cleanup access only to the bucket or prefix you authorize; the customer controls the final IAM policy.
Zero-retention credentials, limited-retention content
The free preview stores only its three selected calls in a randomly named, private Cloudflare R2 bucket dedicated to that trial. Its authorization and findings live in a dedicated SQLite Durable Object. Access ends at the deadline, and the bucket content plus Durable Object state are deleted with alarm retries and an R2 lifecycle backstop. The paid export streams Gong content into the customer-owned S3 destination.
- Job metadata: start time, status, file count, byte count
- Export progress: which recording IDs have been processed
- HMAC-SHA-256 of your IP address for rate limiting
- Your account identity, trial status, content-free findings, and purchase events
- Gong API access keys or secrets
- S3 destination credentials
- Raw call inventory in Postgres
- Trial recordings, transcripts, or Gong metadata after the three-day deadline
- Participant data in analytics or funnel events
Encryption in transit and at rest
All communication between portshift and external services uses TLS 1.2 or higher. This covers:
- Browser → portshift API
- Worker → Gong API (inventory and recording download)
- Worker → Cloudflare R2 trial storage / customer S3 destination
- Worker → portshift database (job state)
Certificate validation is enforced. We do not permit self-signed certificates in any production path.
Trial artifacts are encrypted at rest in private Cloudflare R2. Paid export data lives in your S3 under your account's policies:
- Amazon S3: SSE-S3 or SSE-KMS with your KMS key
- Cloudflare R2: encrypted private trial storage with a three-day deletion policy
portshift's own database (Neon Postgres) is encrypted at rest by the cloud provider.
Infrastructure and isolation
Portshift uses managed Cloudflare Containers without a persistent application filesystem. A container can process more than one bounded run, so isolation is enforced by per-run credential closures, per-job database leases and manifests, per-trial buckets and Durable Objects, and customer-specific destinations.
Containers can be stopped and replaced by the platform. Portshift does not use local disk as durable customer storage.
Every run gets its own source and destination adapters, in-memory credentials, execution lease, and manifest scope. Credentials are never placed in module-global state.
Production services use encrypted provider infrastructure and explicit customer isolation. Destination residency is governed by the S3 region you choose.
Integrity tracking
The migration engine records each artifact's state, destination path, byte count, and SHA-256 digest in its resumable database manifest. A standalone manifest copied into the customer-owned S3 destination is a pre-launch requirement and is not yet represented as shipped functionality.
- SHA-256 hash of every exported file
- Gong call ID, artifact kind, and destination path
- Per-artifact status, attempts, and verified timestamp
- Job-level file and byte counters
Copy a documented, customer-readable manifest into the destination and provide an independent verification command.
Status: planned — not yet shippedUntil that lands, do not treat portshift as an independent compliance archive or certification product.
What we're working on
Engage an independent third party to test the API surface, credential handling pipeline, and storage integration layer before making any recurring-test commitment.
Documented IR runbooks, 24-hour breach notification SLA to affected customers, and a public security advisory page.
Bring-your-own-key encryption for the job metadata stored in portshift's database, for customers who require full key ownership.
Responsible disclosure
If you discover a security issue in portshift's platform, please report it tosecurity@portshift.app. Include the affected URL or component, reproduction steps, and potential impact. We will triage the report and respond as soon as practical, and we welcome coordinated disclosure while an issue is being investigated.