Security
How Harbor Cloud protects your account
Review how Harbor Cloud handles your data and where its protections have limits. Controls marked Implemented are available; Roadmap features are still planned.
Transport and network
The public site, sign-in pages, and customer portal use a Content-Security-Policy that blocks third-party scripts. Responses include Strict-Transport-Security, X-Content-Type-Options, and a restrictive Referrer-Policy. Permissions-Policy blocks camera, microphone, geolocation, and payment access by default.
Report a security issue
Send vulnerability reports and security questions to [email protected].
Sign-in and consent
ImplementedYou sign in to your Private Harbor with a passkey on your device. When you connect a new site, Harbor shows you the information it requests and asks for your approval before sharing it.
ImplementedEach connected site, or relying party, receives a different account ID called a pairwise identifier. Sites cannot match your accounts using those IDs alone. They may still recognize you through other information you share, such as your email.
Who sees what
What Harbor sees
Implemented- Your passkey's public key and device attestation metadata. Harbor does not receive the private key.
- The account ID issued for each site you've connected.
- Your consent history: which information you approved sharing with each site, and when.
- Timestamps for sign-ins, sign-outs, and consent changes.
What Harbor Cloud sees
Implemented- Your account and billing contact details. Name and email fields are encrypted at rest.
- Your subscription, usage, and API key metadata.
- Audit logs showing who changed account configuration and when.
- Access logs for sites it operates, including IP address, user agent, requested path, and timestamp.
What a connected site sees
Implemented- The pairwise identifier for your account at that site.
- The information you approved sharing, such as a verified email address. No other account attributes are shared by default.
- Harbor does not send the site your passkey, IDs for other sites, or Harbor Cloud billing and account details.
Data storage, deletion, and account recovery
- ImplementedHarbor Cloud encrypts tenant and billing contact names and emails at rest with AES-256-GCM envelope encryption. Each tenant has a data-encryption key, protected by a key-encryption key stored outside the database.
- ImplementedThe public site, sign-in pages, and customer portal use TLS to encrypt traffic.
- ImplementedAfter a tenant cancels and requests erasure, Harbor Cloud destroys its data-encryption key. This crypto-shredding makes the encrypted values unrecoverable. Processing begins within 24 hours and finishes within 30 days across the control plane, billing, SAML, and payment provider.
- ImplementedHarbor Cloud retains financial and tax records, a limited security ledger, and proof of erasure for defined periods to meet legal, financial, and security requirements. It deletes or crypto-shreds the remaining data covered by the request.
- ImplementedBackups containing tenant data expire within 30 days. After restoring a backup, Harbor Cloud reapplies subsequent erasure requests before serving traffic.
- ImplementedIf you lose access to all your registered passkeys and have no other recovery method configured, Harbor cannot restore your account access. Harbor does not hold a backup of your passkey private keys.
Planned features (not yet available)
- RoadmapRecovery-contact enrollment is planned. It would give you another way to prove account ownership if you lose all your passkeys.
- RoadmapSelf-service data export is planned. Email [email protected] to request a copy of your data.
Cookies and logs on this site
- ImplementedThe public information pages set no cookies and do not read or require your customer portal session cookie.
- ImplementedThe public site runs no third-party analytics, advertising, or session-replay scripts. Its Content-Security-Policy blocks third-party scripts, connections, and images.
- ImplementedThe web server logs each request, including visits to public pages, for security and troubleshooting. Logs include IP address, user agent, requested path, and timestamp.
Planned features (not yet available)
- RoadmapA public page showing service status and uptime history is planned.