Skip to main content
We treat security as a product feature, not a checklist. Here’s the concrete picture — what’s enforced today, what’s coming, and what’s your responsibility.

​
Data in transit

  • TLS 1.2+ required on every endpoint (api.infery.ai, core.infery.ai, app.infery.ai, infery.ai)
  • HSTS with preload on the marketing and app domains
  • No plaintext fallback — HTTP requests are 308-redirected to HTTPS, then refused

​
Data at rest

  • PostgreSQL (Cloud SQL): AES-256 disk encryption, automated daily backups (35-day retention), point-in-time recovery
  • Object storage (GCS): AES-256 at rest, Google-managed keys
  • Redis (Memorystore): AUTH + in-transit TLS; never stores raw inputs/outputs — caching layer only
  • Secrets: GCP Secret Manager, never in env files in CI

​
Inputs and outputs

  • Not stored by default for API requests — payloads transit through the gateway and are not persisted
  • Studio chats are stored in your workspace per retention rules
  • Request metadata (timestamps, model, tokens, status, latency, IP, user-agent, request id) is kept for 30 days for diagnostics, then deleted
  • Billing-grade usage events are kept for 6 years (HMRC requirement)
  • Internal audit records of privileged actions are kept for security investigations. They are ours, not a customer-facing trail: there is no audit page and no export
  • No model training on your data, ever — see the legal page

​
API keys

  • Stored as SHA-256 hashes of the full key; the plaintext is shown once, at creation, then unrecoverable. Only the first 16 characters are kept in the clear, to label the row
  • Format: inf_live_ + 32 random bytes as hex — 256 bits of entropy, and a fixed prefix that makes a leaked key greppable in code, logs and history
  • Per-key scope: the only state attached to a key is workspace + permissions + rate-limit profile. Keys never carry user identity
  • Rotation: any number of keys per workspace; rotate freely with zero downtime
  • Revoke in one click — effective on the next request. The gateway reads the key’s status from the database on every call and caches nothing, so there is no propagation window to wait out

​
Authentication

  • Web app: email + password (bcrypt, work factor 12), Google OAuth, GitHub OAuth
  • Email verification required before first paid action
  • 2FA (TOTP / passkey) optional per user; mandatory on Workspace Admin role for Team and Enterprise plans
  • Session cookies: HttpOnly, Secure, SameSite=Lax, signed; rolling 30-day TTL with rotation on every login
  • Brute-force: per-IP and per-account rate limiting on /login, /register, /password-reset

​
Authorisation

  • Workspace-scoped by default — no cross-workspace data access at the database layer (RLS-style)
  • Roles: Owner, Admin, Developer, Billing, Viewer — see Members and roles
  • API keys cannot escalate privileges or read/write workspace settings — they only call the inference API

​
Network and infrastructure

  • All services run in GCP europe-west1 (St. Ghislain, Belgium). There is one region — we do not offer a choice of region, and nothing is replicated outside it. A prompt sent for inference does leave for the model provider
  • Workload Identity Federation for CI → no service-account keys in GitHub
  • Private VPC for service-to-service traffic; only the public gateway and web app are exposed
  • Cloud Armor + per-IP rate limits at the edge
  • DDoS protection via Google Front End

​
Compliance and certifications

  • UK GDPR + EU GDPR compliant — see Privacy Policy
  • CCPA / CPRA compliant for California residents
  • No third-party security certification is in place. We hold neither a SOC 2 attestation nor ISO 27001, and we do not claim either is pending — if that changes, this page changes with the evidence
  • HIPAA and PCI-DSS are not in scope, and no BAA is offered

​
Incident response

  • 24/7 on-call rotation
  • Personal data breach → notification to ICO within 72 hours, affected users notified without undue delay

​
Vulnerability disclosure

We run a good-faith policy. Email security@infery.ai with details — don’t disclose publicly until we’ve had a reasonable window to fix. We acknowledge within 24 hours, target a fix within 30 days, and credit reporters in our changelog (with your permission). We don’t currently run a paid bounty programme; that’s planned for late 2026.

​
What’s your responsibility

  • Keep API keys out of client-side code — frontend should call your backend, your backend calls Infery
  • Rotate keys on staff departure
  • Use separate keys per environment (dev, staging, prod) so you can revoke surgically
  • Enable 2FA on every Owner/Admin account
  • Set budget alerts so a leaked key can’t drain you overnight

​
Reporting suspected misuse

If you see Infery being used for abuse — phishing, scams, malware — email abuse@infery.ai. Include the request id from response headers if you have one. For lawful disclosure requests (subpoena, court order), email legal@infery.ai.