How it works
How to sign in with Harbor
Create a Private Harbor account, register a passkey, then choose which sites to connect. Harbor asks for your consent before sharing information with a new site.
Create your Private Harbor
Register a passkey on your device. You'll use it to sign in to your Harbor account.
Choose a site to connect
When you choose "Sign in with Harbor," Harbor shows you the information the site requests. Review it before you approve the connection.
The site receives its account ID
After you approve, Harbor sends the site an ID for your account. This pairwise identifier is specific to that site.
Sign in again
Use your passkey when you return. The site receives the same ID as before, so it recognizes your account. Other sites receive different IDs.
Disconnect a site
Revoke a site's access from your dashboard when you no longer want it connected. Harbor stops accepting that connection immediately.
Sign-in and consent
ImplementedYou sign in to your Private Harbor with a passkey on your device. When you connect a new site, Harbor shows you the information it requests and asks for your approval before sharing it.
ImplementedEach connected site, or relying party, receives a different account ID called a pairwise identifier. Sites cannot match your accounts using those IDs alone. They may still recognize you through other information you share, such as your email.
Who sees what
What Harbor sees
Implemented- Your passkey's public key and device attestation metadata. Harbor does not receive the private key.
- The account ID issued for each site you've connected.
- Your consent history: which information you approved sharing with each site, and when.
- Timestamps for sign-ins, sign-outs, and consent changes.
What Harbor Cloud sees
Implemented- Your account and billing contact details. Name and email fields are encrypted at rest.
- Your subscription, usage, and API key metadata.
- Audit logs showing who changed account configuration and when.
- Access logs for sites it operates, including IP address, user agent, requested path, and timestamp.
What a connected site sees
Implemented- The pairwise identifier for your account at that site.
- The information you approved sharing, such as a verified email address. No other account attributes are shared by default.
- Harbor does not send the site your passkey, IDs for other sites, or Harbor Cloud billing and account details.
Data storage, deletion, and account recovery
- ImplementedHarbor Cloud encrypts tenant and billing contact names and emails at rest with AES-256-GCM envelope encryption. Each tenant has a data-encryption key, protected by a key-encryption key stored outside the database.
- ImplementedThe public site, sign-in pages, and customer portal use TLS to encrypt traffic.
- ImplementedAfter a tenant cancels and requests erasure, Harbor Cloud destroys its data-encryption key. This crypto-shredding makes the encrypted values unrecoverable. Processing begins within 24 hours and finishes within 30 days across the control plane, billing, SAML, and payment provider.
- ImplementedHarbor Cloud retains financial and tax records, a limited security ledger, and proof of erasure for defined periods to meet legal, financial, and security requirements. It deletes or crypto-shreds the remaining data covered by the request.
- ImplementedBackups containing tenant data expire within 30 days. After restoring a backup, Harbor Cloud reapplies subsequent erasure requests before serving traffic.
- ImplementedIf you lose access to all your registered passkeys and have no other recovery method configured, Harbor cannot restore your account access. Harbor does not hold a backup of your passkey private keys.
Planned features (not yet available)
- RoadmapRecovery-contact enrollment is planned. It would give you another way to prove account ownership if you lose all your passkeys.
- RoadmapSelf-service data export is planned. Email [email protected] to request a copy of your data.
Cookies and logs on this site
- ImplementedThe public information pages set no cookies and do not read or require your customer portal session cookie.
- ImplementedThe public site runs no third-party analytics, advertising, or session-replay scripts. Its Content-Security-Policy blocks third-party scripts, connections, and images.
- ImplementedThe web server logs each request, including visits to public pages, for security and troubleshooting. Logs include IP address, user agent, requested path, and timestamp.
Planned features (not yet available)
- RoadmapA public page showing service status and uptime history is planned.