Security
A technical disclosure, not a marketing claim
This page is written for security reviewers. Every control below is labelled Implemented or Roadmap — we don't describe planned work in shipped-sounding language, and we don't make claims we can't back with an in-repo, linked artifact.
Transport and network
Every response from Harbor Cloud — the public site, sign-in, and the authenticated portal — carries a strict Content-Security-Policy with no third-party script origins, along with Strict-Transport-Security, X-Content-Type-Options, a restrictive Referrer-Policy, and a Permissions-Policy that denies camera, microphone, geolocation, and payment access by default.
Passkeys, with your explicit consent
ImplementedSigning in to a Private Harbor uses a passkey — a device-bound cryptographic credential — instead of a password. Every time you connect your Harbor identity to a new site, you see and approve exactly what that site will receive before anything is shared.
ImplementedHarbor issues a distinct, pairwise identifier for every relying party your Private Harbor connects to. Because each relying party only ever receives its own identifier, sites cannot automatically correlate the same person across relying parties.
Who sees what
What Harbor sees
Implemented- Your passkey's public key and device attestation metadata — the private key never leaves your device and is never sent to Harbor.
- The distinct pairwise identifier issued for each relying party you've connected.
- The consent grants you've approved: which attributes go to which relying party, and when.
- Authentication event timestamps (sign-in, sign-out, consent changes).
What Harbor Cloud sees
Implemented- Your tenant/account and billing contact details, with name and email fields encrypted at rest.
- Subscription, usage, and API-key metadata for your tenant.
- Administrative audit-log entries recording who changed tenant configuration, and when.
- Standard web-server access logs (IP address, user agent, requested path, timestamp) for the sites it operates.
What the relying party sees
Implemented- Only the pairwise identifier assigned to your account at that specific site — not the identifier used at any other site.
- Only the attributes you explicitly approved sharing during consent (for example, a verified email address), and nothing else by default.
- Nothing about your passkey, your other pairwise identifiers, or your Harbor Cloud billing/account data.
Encryption, retention, recovery, and deletion limits
- ImplementedTenant and billing contact fields (name, email) are encrypted at rest using AES-256-GCM envelope encryption: each tenant gets its own data-encryption key, itself wrapped under a key-encryption key held outside the database.
- ImplementedAll traffic to Harbor Cloud — the public site, sign-in, and the authenticated portal — is served over TLS.
- ImplementedWhen a tenant is cancelled and erasure is requested, Harbor Cloud destroys (crypto-shreds) that tenant's data-encryption key, which makes previously encrypted values unrecoverable. Erasure requests begin processing within 24 hours and complete within 30 days across the control plane, billing, SAML, and payment provider.
- ImplementedFinancial and tax records, a minimized security ledger, and proof that erasure occurred are retained for a defined period after deletion, as required for legal, financial, and security purposes — everything else in scope is deleted or crypto-shredded.
- ImplementedBackups containing tenant data expire within 30 days; restoring from a backup replays any erasure that happened in the meantime before serving traffic again.
- ImplementedIf you lose access to every passkey registered to your Private Harbor and have not configured another recovery method, Harbor cannot restore access to your account — passkey private keys never leave your device and are not held in escrow by Harbor.
On the roadmap — not yet available
- RoadmapSelf-service recovery-contact enrollment — a second, independent way to prove account ownership if every passkey is lost — is planned and not yet available.
- RoadmapA self-service data-export tool is planned and not yet available; until then, contact support to request a copy of your data.
Cookies and logs on this site
- ImplementedThe public marketing and trust-center pages set no cookies, and do not read or require the authenticated portal's session cookie.
- ImplementedNo third-party analytics, advertising, or session-replay scripts run on the public site; its Content-Security-Policy does not permit third-party script, connection, or image origins.
- ImplementedStandard web-server access logs (IP address, user agent, requested path, and timestamp) are recorded for security and operational troubleshooting on every request, including to the public site.
On the roadmap — not yet available
- RoadmapA public status/uptime history page is planned and not yet published.