Understanding Data Processing and Sub-processors in Our Service

Data Processing and PII Handling

Our service is designed to operate within your infrastructure. This means that we do not directly process or store your Personal Identifiable Information (PII) or customer data. All of your PII and sensitive data remain within your infrastructure.

Sub-processor Status

Despite providing infrastructure services, we are not considered a sub-processor in the traditional sense. This is because we do not have direct access to or process your data. Our role is limited to providing the platform on which your infrastructure runs.

Data Processing Agreement (DPA)

As we do not process your data, we typically do not enter into Data Processing Agreements (DPAs) with our customers. However, we understand that you may need to list us in your own DPA documentation due to our role in providing infrastructure services.

Business Associate Agreement (BAA)

Porter doesn’t offer BAAs - however, users would need a BAA with the underlying cloud provider (AWS) if storing ePHI in any databases. Porter doesn’t store any user logs or images on our end. Logs are all stored and retrieved from an on-cluster logging stack Porter sets up within your infrastructure. The Porter dashboard provides a pane of glass similar to the Porter CLI that lets you directly view the logs stored within your cluster but these are not retained by Porter.

SOC 2 Report and Sub-processors List

While we may not be a direct sub-processor, we recognize the importance of transparency in data handling and security. We offer our SOC 2 report, which includes a list of our sub-processors, to customers who require this information for their compliance documentation.

Requesting Information

If you need specific information about our company for your DPA or other compliance documentation, please contact our support team. We can provide details such as:

• Our business address

• A contact email for privacy-related inquiries

• Information about the countries in which our services operate

Please note that while we're happy to provide this information, it does not change the nature of our relationship or imply that we process your data directly.

Further Questions

If you have any additional questions about data processing, privacy, or our role in your infrastructure, please don't hesitate to reach out to our support team. We're here to help clarify any concerns and provide the information you need for your compliance efforts.