Skip to content
Portproof
Get proxies

Privacy notice and logging policy · v1 · 2026-09

Privacy and logging

Portproof is the controller for account, billing and verification data and a processor for traffic metadata processed on customers' instructions under the DPA. This notice describes what is collected, why, and for how long.

1. What we log about proxy traffic

  • subscriber to port to egress IP to time (egress_ip_assignments)
  • per-minute usage aggregates per port
  • rotation log entries and probe results
  • a per-destination-ASN five-minute aggregate kept 30 days for abuse triage

Not logged

  • payload
  • URLs
  • per-flow records

There is no "zero logs" claim. The subscriber-to-egress-IP-to-time record exists so that a lawful request can be answered and so that uptime credits and Port details can be computed.

2. Retention

90 days by default; the statutory period where the service is classified as an electronic communications service in the country of the egress SIM; 12 months for Attested customers who opt in. Retention is configured per jurisdiction of the egress SIM.

3. Account and KYB data

Legal name, country, registry and VAT identifiers, registered address, UBO declaration, declared use case, sanctions-screening results and timestamps, signatory identity verification results (T2, via an identity-verification vendor), billing records and support correspondence. Legal bases: contract, legal obligation (sanctions, tax, telecom), and legitimate interest (abuse prevention, security). A DPIA and legitimate-interest assessment cover session metadata, anomaly detection, reputation scoring and identity verification.

4. Third-party data in Port details

Geolocation uses MaxMind GeoLite2 and IP2Location LITE with attribution and IPinfo. Reputation flags are derived by us from vendor lookups; raw vendor scores are not redistributed and stay internal until redistribution terms are signed.

5. Sub-processors

Our hosting provider, our transactional email provider, the network partner that carries proxy traffic, the identity-verification vendor (tier T2 only) and the payment processor that handles your payment. The current list with the transfer mechanism of each is sent on request. Hosting is in the EU.

6. Your rights and contact

Access, rectification, erasure, restriction, portability and objection under the GDPR; complaints to the data protection authority of your country or to the Lithuanian State Data Protection Inspectorate. Contact support@portproof.org. The contact point for authorities and the law-enforcement guidelines are published separately.