Security
What protects your account, what you control, and what to do if something looks wrong.
What we hold, and how#
Your PortModels password is stored and managed by the PortModels console. This website does not collect a second password. API keys are stored hashed too — only a short preview is retained so you can identify them. Card details are never stored by PortModels; the payment processor holds them.
What apps can see#
An app you connect receives a scoped access token. It never receives your
password, and it never receives more access than the
scopes you approved. An app with models.run cannot
read your files; an app with kv.read cannot see another app's data.
Review what you have granted under Connected apps, and disconnect anything you no longer use.
Recognising phishing#
PortModels will never ask for your password by email, never ask you to paste an API key into a chat, and never ask you to approve a Connect screen you did not start yourself.
Before approving a consent screen, check three things:
- The app name is the one you meant to use.
- The scopes match what the app plausibly needs. A wallpaper generator
asking for
files.readdeserves a second look. - The URL is on
portmodels.com. A consent screen anywhere else is not ours.
If something looks wrong#
- Change your PortModels password. This ends other sessions.
- Revoke your API keys and issue new ones — see API keys.
- Disconnect apps you do not recognise.
- Read your history. Compare billing history and your usage log against what you actually ran.
- Tell us. Contact support with what you found and when.
Reporting a vulnerability#
Found a flaw in PortModels itself? Email [email protected] with enough detail to reproduce it, and give us a chance to fix it before disclosing publicly. Please don't test against other people's accounts, apps, or data.