Privacy policy

This policy says what Porticol does with personal data. It applies to this website, to Porticol Cloud, to the Porticol Team Server where we operate one, and to the desktop application, which by itself sends us nothing.

It takes effect on 21 Oct 2026.

1. Who is responsible for your data

{{PLACEHOLDER:LEGAL_ENTITY_NAME}} ("Porticol", "we") is the controller for personal data about people who use Porticol Cloud, this website and the web client, and for personal data in the Team Server installations we operate for enterprise customers.

Where an organisation runs its own Team Server, that organisation is the controller for the data in it. We act as a processor on its documented instructions under the data processing agreement.

Our privacy contact is privacy@porticol.app. Our postal address is {{PLACEHOLDER:LEGAL_ENTITY_ADDRESS}}.

{{PLACEHOLDER:EU_UK_REPRESENTATIVE}} is our representative in the European Union and the United Kingdom, where one is required.

2. The desktop application

The desktop application works with no account and keeps its data on your machine. In a SQLite database next to your other application data it holds your collections, requests, environments, examples, settings and send history, with credential headers redacted. Secret values are held in your operating system's keychain, and protocol session transcripts are stored with the same redaction.

Requests you send leave from your machine, to the host you addressed. They do not go through our servers, and their contents do not reach us.

A desktop application with no account sends us nothing at all. Once you sign in, it sends what your workspaces need in order to synchronise: the collection and environment documents you choose to share, and the changes you make to them. History, drafts and local-only workspaces stay on your machine and never upload.

Crash reports and usage reports are off by default. If you turn either on, reports are queued on your machine and sent to an intake endpoint we host, built from names, counts and versions. They carry no request content, and the intake refuses an upload that holds an address, a URL, a home path or a credential shape.

3. What Porticol Cloud stores

For an account:

your email address, display name, and whether you have verified it;
your sign-in method: a password hash, or the identity and profile your provider returned for a Google, GitHub, SAML or OIDC sign-in;
your sessions and your devices, each with a name, a creation time and a last-seen time;
the organisations and workspaces you belong to, your role in each, and your groups;
your second-factor enrolment, and your organisation's sign-in policy.

For a synchronised workspace:

the collection and environment documents you share, their change history and their current revision;
runs, monitor schedules and monitor runs, mock definitions and mock call counts;
the audit log, which records the actor, the time, the source address, the resource and the outcome of every security-relevant or data-changing action, in a tamper-evident chain;
your retention settings and what the nightly retention run removed.

For billing:

your organisation's plan, the seats bought, the payment provider's customer identifier, and the invoices issued.

For shared secrets:

public keys, keys wrapped for each enrolled device, and encrypted secret values. We store no key that opens them.

When an organisation has SIEM destinations, its audit entries are sent to the addresses its administrators chose. When an organisation has single sign-on, its members' sign-ins go to its identity provider, and we fetch only that provider's public metadata, keys and token endpoint.

4. What we do not collect

The requests your desktop application sends, or their headers, bodies or responses.
Crash or usage reports, unless you turn them on.
Usage analytics about the desktop application. We do not count the screens or commands you use unless you turn usage reports on.
Trace data from our servers. Trace export is off unless an operator turns it on, and the server makes no outbound connection of its own with no licence service configured.
Analytics about this website or the web client. Neither runs an analytics or measurement tool, and neither sets a cookie to measure you.
Advertising data. We do not run advertising, and we do not sell or share personal data for anyone else's marketing.

5. Why we use it, and on what basis

Purpose	Basis
Running an account, synchronising workspaces and operating the service	Performance of our contract with you
Keeping the service secure: audit log, sign-in records, lockouts, rate limits	Our legitimate interests in protecting the service and its users
Diagnosing faults you ask us about	Our legitimate interests, and your consent where we attach diagnostics
Sending you service and security notices	Our legitimate interests in telling you about changes to the service you use
Billing, invoices and tax records	Our contract with you, and the tax law that applies to us
Optional crash and usage reports	Your consent, which you can withdraw
Meeting a legal obligation, and establishing or defending legal claims	The obligation, and our legitimate interests in the claim

Where we rely on legitimate interests, you can ask what we consider those interests to be and object to the processing; see the contact details below.

6. Cookies

This website sets no cookies. The web client sets only the cookies it needs to sign you in and to complete a single sign-on, and none that measures you, so there is nothing to agree to. The cookie notice lists each one.

7. Who we share it with

We use the suppliers listed in subprocessors.md. They process personal data only for the purposes set out there and under our instructions.

We also disclose personal data:

to another member of your organisation or workspace, where access is shared with them;
to your identity provider, where your organisation has configured one;
to your organisation's SIEM destinations, where it has configured them;
to Stripe, our payment provider, which needs your email address and plan to take payment;
where a public authority requires it, or to establish or defend legal claims;
as part of a sale of the business, with notice to you before the data moves.

We do not disclose personal data to anyone else.

8. Where your data is kept

Porticol Cloud runs on Amazon Web Services. Your data is kept in the us-east-1 region, in Northern Virginia in the United States, and backups are replicated to the us-west-2 region, in Oregon in the United States.

We transfer personal data from the United Kingdom and the European Economic Area to the United States under the European Commission's standard contractual clauses, with the UK International Data Transfer Addendum for data from the United Kingdom. Write to privacy@porticol.app for a copy.

Per-organisation data residency is not available in this release. Every row carries its organisation, so the model supports it later.

A Team Server you install stays where you install it. An air-gapped installation makes no outbound connection except the licence check, which an offline licence replaces with a file import.

9. How long we keep it

Collection and environment documents, runs, monitor runs, request history, the audit log and the sync log: for as long as your organisation keeps them. Each has a retention period in days that your organisation's owners set, within the limits of the plan. A nightly job removes what is past the period and records how much it removed. Until a period is set, nothing is removed by age.
Synced documents: as long as your organisation keeps the workspace.
Exports you ask for: seven days, or until downloaded once.
Optional crash and usage reports: 30 days, after which a daily job deletes them.
Account data after you delete your account: deleted within 30 days. Work you shared in a workspace stays, attributed to "Deleted user".
Invoices and tax records: 7 years, including after an account or organisation is deleted.
Records of failed sign-ins and lockouts: 1 year.
Infrastructure and access logs, which hold IP addresses: 1 year.
Database backups: 35 days. Each backup ages out after that, so data deleted from the service leaves the backups within 35 days.

10. Your rights

Where we are the controller, you can:

ask what personal data we hold about you, and get a copy: the account page has a JSON export of everything we keep about you;
correct it, on the account page;
delete your account, on the account page. Deletion removes your name, address and sign-in details, signs you out everywhere, and is recorded in the audit log. It is refused while you are the only owner of an organisation;
ask us to restrict or stop processing, object to processing based on legitimate interests, or ask for a portable copy in a structured format;
withdraw consent, where you gave it, without affecting processing before you did;
complain to your data protection supervisory authority.

We answer a request within one month. Where a request is complex, or you send many, we may take up to two months more, and we tell you so within the first month. We may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

Your organisation's owners control the personal data of its members in its workspaces. To reach it, ask an owner, who can export or delete the organisation.

11. Security

We describe our controls in the security policy and our threat model in the project's repository. In summary: traffic is TLS, a desktop's secret values are in your operating system's keychain, shared secrets are encrypted on your device before they are sent, the database isolates each organisation by row-level security, and every security-relevant action is written to a tamper-evident audit log.

No system is perfect. If a breach of personal data affects you, we tell the relevant supervisory authority within 72 hours of becoming aware of it, where the law requires, and tell you without undue delay where it is likely to put your rights at high risk. We tell you what happened and what we did.

12. Children

Porticol is a tool for people who work. You must be at least 16 to use Porticol Cloud or to create an account, and we do not knowingly collect personal data from anyone younger. If you think someone under 16 has given us personal data, write to privacy@porticol.app and we will delete it.

13. Changes to this policy

We will post any change here and change the date at the top. We tell you about a material change by email at least 30 days before it takes effect. If you cannot accept it, you can export your data and delete your account before then.

14. Contact

Privacy questions, requests and complaints: privacy@porticol.app. Postal address: {{PLACEHOLDER:LEGAL_ENTITY_ADDRESS}}.

Security reports: security@porticol.app, as described in the security policy. That address is for vulnerabilities, not for personal data.