Security
Read-only. Signed.
Nothing gets in.
Porro was built by an agency that has to answer to its own clients’ IT teams. Here is exactly what we collect, how it travels and where it lives.
- 01 Runs on schedule Every 15 minutes, and after every deploy.
- 02 Builds a report Versions, health results and a hash of composer.lock.
- 03 Signs and sends Signed with the site key, posted over HTTPS.
- 04 Verified Signature, timestamp and replay window are checked, then the rules run.
- 05 Silence is a signal Two missed reports means cron has probably stopped.
What leaves a site
✓Framework, CMS, PHP and package versions
✓Health results (scheduler, queues, backups)
✓A composer.lock hash, plus the file itself when it changes
✓Environment checks as true or false
What never does
✕Content, entries or uploads
✕Customer or user data
✕Environment values or secrets
✕Anything that lets us connect back in
Keys
One key per site, shown once. Porro stores only its public half. Reports are signed with a timestamp and rejected outside a 5-minute window or on replay.
Ed25519 · 5 min window
Direction
The connector only sends. Porro never connects into a site, so no inbound access or firewall changes are needed.
outbound HTTPS only
Outside checks
Ordinary HTTPS requests that identify themselves as PorroBot, from the check regions your workspace chooses.
User-Agent: PorroBot/1.0
Accounts
Every member uses two-factor authentication, whether they sign in with a password, a passkey, Google or GitHub. People join a workspace by invitation, with owner, admin and member roles.
TOTP · passkeys · Google · GitHub
Data
Hosted in the UK, on Laravel Cloud in London. Check results are kept in full for 2 days, then as hourly summaries for up to 90 days and daily ones after that, for as long as your plan’s history (30 days to 25 months), then deleted. Delete your workspace and everything in it at any time.
London · by plan
API tokens and audit log
On Agency and Enterprise, API tokens are shown once and never stored in plain text, can never do more than their owner’s role allows, and stop working when revoked or when their owner leaves. The audit log records who changed what, including every change made with a token.
shown once · role-capped
Open source
Connector code is public, so agencies and their clients can read exactly what leaves a site.
github.com/porrodev
GitHub, if you connect it
Opens pull requests to add a connector or update packages. Never pushes to a main branch and never merges. Works across several accounts and organisations; remove any of them in Settings.
pull requests only
Forge, Ploi or Laravel Cloud, if you connect them
Lists sites for import. When you install a connector, sets PORRO_KEY in the site’s environment and adds one report line to the end of its deploy script (on Cloud, its deploy commands). Never deploys, and never asks for access that runs commands on your servers.
env + deploy step
Disclosure
Found something? Email [email protected]. We reply within one working day.
Try it on your sites.
28 days free, no card needed. Import your sites from Forge, Laravel Cloud or Ploi in a couple of minutes.