Security

How Porticol protects your requests, your secrets and your organisation.

On your computer

Requests leave from your computer, not from our servers. Monitors are the one exception, described below.
Secret values are kept in the operating system's keychain, released only to send a request, and masked in history, transcripts and errors.
The app's interface cannot reach the network itself, which its content security policy forbids, and has no access to your files. The end-to-end tests run under the same policy.
Crash and usage reports are off by default. When you turn them on, Settings shows exactly what is sent, and a report never holds request content.

Each desktop has its own key pair. Values are encrypted on the desktop, and the server stores only public keys, wrapped keys and ciphertext, none of which it can open.
When a member leaves or a device is signed out, the workspace's keys are replaced.

Each update's manifest and files are signed. The app reads nothing in a manifest before its signature checks out.
Updates come over HTTPS, and an older version is never installed.

Every route declares the permission it needs, and a test fails when a route is public by accident.
Each organisation's rows are kept apart by row-level security in Postgres, and a test fails when a route has neither a cross-organisation case nor a recorded reason for having none.
Secret columns are encrypted under the installation's key, and backups are encrypted the same way.
The audit log is chained and checked for tampering.
Sign-in is rate limited and locks out after repeated failures.
The server sends no telemetry.

Monitors are the one place where our servers send your requests.
On Porticol Cloud each monitor request goes over HTTPS through a guard that checks every address the host resolves to, refuses loopback, private, link-local and cloud metadata addresses, never follows a redirect and caps the size of the answer.
Alerts go only to destinations an administrator has allowed.

Dependencies are checked against security advisories on every build, and a new advisory fails it.
Every parser is fuzzed on a schedule.
Release builds are checksummed and come with a CycloneDX bill of materials.