Security

A harbour, not a fortress.

Rules are enforced on Portward's side, on the data itself. Credentials stay in a vault. Every delivery leaves a record. These protections are the same on every plan.

Get started How rules work

01On every plan

Protections are never plan features.

You should not have to pay more to be safe. These five apply to a person on the free plan exactly as they do to an enterprise.

Authentication

Every request is tied to a signed-in person or a registered service. Who is asking comes from authentication, never from what the request claims.

Authorization

Permissions come from your organization. An identifier supplied by an AI tool is treated as a request for scope, not as proof of it.

Source restrictions

Rules set on a source are enforced wherever that source is used. If Portward cannot enforce a restriction on a route, it blocks the route.

Secret protection

Credentials are kept in a vault and resolved only on paths you authorized. They never appear in logs, errors, receipts or anything sent to an assistant.

Audit recording

Each delivery leaves a record of who asked, what was checked and what was sent.

02Where things go

What happens to what you give us, in plain words.

Before you connect anything, you should know where it goes and who can see it.

Your credentials

Stored as vault references. The people asking questions never see or handle them, and an assistant never receives them.

Your queries

Portward does not run arbitrary code or arbitrary queries over protected data. Operations and their parameters are bounded and validated, then run by an isolated worker that holds restricted credentials. Checking the query is never the only protection.

Your results

Only what the rules permit is sent to the assistant. A withheld field is held back on Portward's side. It is not sent and then hidden.

Your team's knowledge

Published knowledge does not change after approval. An approval covers the exact content that was reviewed, and a correction becomes a new version. The reviewer's identity comes from their sign-in, not from the text of a request.

AI models

Connecting a source and reading its structure make no AI model call. Portward-run AI processing, such as optional AI discovery, needs a paid plan and an explicit opt-in from you.

03Where Portward is today

In beta, and we say so.

We would rather tell you what is not here yet than have you find out later.

True today
Data access is read-only. Portward does not write to your sources, even when a credential could.
True today
The protections on this page apply on every plan. None of them is a paid feature.
Not yet
Portward is in beta. We have no customer references to show you.
Not yet
Portward holds no third-party security certification. When that changes, it will be stated here.

04Questions

What a careful person asks.

Is a rule enforced on the data, or is it a description the AI is asked to follow?

It is enforced. The check runs on Portward's side before a result leaves. The AI tool is never trusted to apply a restriction, because it cannot be.

Can an assistant talk its way past a rule?

The assistant can ask for anything. What it receives is decided from the signed-in person, the agent, the data, the operation and the destination. Text in a request does not change who is asking or what they may see.

What does Portward see of my conversation?

Portward does not host the conversation. It sees the requests the assistant makes to it and what it sends back. It does not claim to have seen the rest.

Can I leave?

Yes. Export is available on every plan for the material you are entitled to export.

Try it on data that does not matter first.

Connect one source you would not mind being wrong about, set a rule, and watch what your assistant is and is not sent.

Get started See how sources connect