What stays on your servers
Everything PortWall inspects stays with you: on your own servers; the traffic PortWall inspects and the logs it writes stay under your control. Requests, request bodies, visitor addresses, URLs, site names, certificates and the attack records in the console are processed and stored on your server or appliance. There is no third-party cloud proxy in the path of your traffic.
What a PortWall server sends to PortWall
- Licence check-ins. The server confirms its licence regularly, identifying itself by its installation ID and public address, and reports the PortWall version it runs.
- Attacker summaries (herd immunity). To protect every customer, each licensed server sends summaries of the addresses that attacked it: the attacking IP address, when and how often it attacked, and the kind of attack (for example SQL injection or password guessing). Never sent: visitor data, URLs, request contents, site names, private addresses and addresses on your allowlist. PortWall keeps these summaries for up to 90 days.
What a PortWall server downloads
Updates, downloaded from dl.portwall.net (each one checked against PortWall's release signature before it is
installed), threat-intelligence feed
lists, the Premium Threat Intelligence list on Premium and above, virtual patches, and the country address database
for geo-blocking. Managed certificates are requested from Let's Encrypt or Google Trust Services.
Turning off contributions
Yes, you can choose not to send attacker summaries. The choice is made in the installer, with its --no-contribute option. To stop contributing on a server that already runs PortWall, write to [email protected].
Anyone can ask for an address to be reviewed or removed from PortWall's threat intelligence by writing to [email protected].
If the server cannot reach PortWall
Protection carries on. A server that cannot confirm its licence stays fully protected for a grace period of up to 72 hours. After that, blocking steps back but detection continues, and blocking returns by itself once the server can confirm its licence again. See Licences, editions and licence states.
Personal data and contracts
For the traffic and security data PortWall processes on your infrastructure, you are the controller. PortWall is based in Ajman Free Zone, United Arab Emirates. The privacy policy covers the information PortWall handles directly (contact, billing and support), and privacy requests go to [email protected].