Security at Postman

Postman uses strong encryption (AES-256-GCM) for data at rest and TLS for data in transit. All sensitive data, including environment variables, secrets, and access tokens, is encrypted at the application layer and managed via a key management system (KMS).

Enterprise customers can also opt for Postman's Bring Your Own Key (BYOK) encryption feature, which enables them to manage and control their own encryption keys. These keys are never accessible by Postman, and all encryption events are logged for compliance and auditing.

Postman does not use customer data in internal testing. All validation and QA efforts are conducted on a production-mirrored internal stack using fictitious data only.

We keep your data in secure offline backups for 15 days after you delete your account or end your relationship with us. After that period, Postman permanently deletes your data from the product.

Postman has no in-house data centers and uses AWS to manage its data centers' physical and environmental security. Our company's product data and backups are hosted on AWS servers in the EU and the U.S., which offer strong security and privacy-focused features.

Postman secures its applications at every layer and phase, from development to deployment and operation. Our applications run on the latest stable version of Node.js, an open-source programming language. We use containerization to isolate software, set architectural security guidelines, and perform code reviews. Industry standards and security frameworks are applied throughout the software development lifecycle, with testing for OWASP vulnerabilities. Annually, third-party firms validate our ecosystem's security, and our bug bounty program allows anyone to report potential vulnerabilities in the Postman API Platform.

Our company's automated and manual code review processes search for any code that could potentially violate corporate security policies. We also have patching mechanisms built into the operating systems to update devices automatically.

We monitor the security of our products and applications through various ongoing activities, including regularly scheduled Vulnerability Assessment and Penetration Testing (VAPT) for all product releases.

We also conduct vulnerability scans on the network, application, and operating system layers at regular intervals throughout the year, enabling us to patch vulnerabilities across Postman's computing devices and applications.

All issues found are assigned a score using the Common Vulnerability Scoring System (CVSS), an owner, and a deadline based on an internal Service Level Agreement (SLA) for fixing vulnerabilities. We may also remove and turn off services.

Additionally, we use an automated tool for source code analysis, which runs before every production release. This tool covers vulnerabilities in open-source software and libraries. You can view applicable third-party licenses and a list of open-source software.

We only share information with third parties to help us operate, support, and market our services. We do not sell your data for commercial purposes or "share" data as defined under the CCPA and CPRA. All third-party vendors, including our sub-processors, undergo a privacy risk assessment and are required to execute our standard vendor DPA. Prospective customers can request access through our Customer Trust Portal. You can also view the complete list of Postman sub-processors.

We log activity across our platform, from individual API requests to infrastructure configuration changes. Logs are aggregated for monitoring, analysis, and anomaly detection and archived in vaulted storage.

Our company further implements measures to detect and prevent log tampering or interruptions. To detect security breaches, we monitor access patterns and network data flow patterns using automated systems that alert us to any anomalies. In addition, we run automated scans on each feature release to ensure we reduce any security issues from third-party libraries.

Also, our leadership team is notified automatically in the event of a customer-reported breach. In accordance with Postman's corporate policies, we respond to the report within a few hours.

Our company has incident response policies and procedures to help mitigate cyber risks around service availability, integrity, security, privacy, and confidentiality. As a result, we train our Postman teams to:

• Promptly respond to alerts of potential incidents
• Analyze and assess the severity of potential incidents
• Execute mitigation and containment measures
• Communicate with relevant internal and external stakeholders. Doing so includes notifying affected customers and meeting contractual obligations around breach or incident notifications.
• Gather and preserve forensic evidence for investigative efforts
• Conduct and document a postmortem while developing a permanent triage plan

The incident response policies and processes are audited as part of our System and Organization Controls (SOC 2) and other security assessments.

Please contact our customer support team or security@postman.com to report potentially abusive behavior or malicious activity involving Postman accounts or resources.

To report a vulnerability, check out our reporting page on HackerOne. Security researchers should also review our security guidelines and policy for reporting security vulnerabilities through our bug bounty program.

If you want additional information about our security policies, please contact us at security@postman.com. You can use our PGP public key to encrypt your communications with us.