Security Policy
Effective Date: July 23, 2026
Last Updated: July 25, 2026
Index
- Overview
- Infrastructure Security
- Authentication
- Access Control
- Encryption
- API Key Security
- Monitoring
- Backups
- Incident Response
- Vulnerability Management
- Responsible Disclosure
- Customer Responsibilities
- Security Updates
1. Overview
Security is an important part of how we design, build, and operate our Services.
We use administrative, technical, and organizational measures intended to protect customer information and maintain the confidentiality, integrity, and availability of our Services.
No security program can eliminate every risk. We continuously improve our practices as our products and infrastructure evolve. Our broader compliance posture, including certifications and questionnaire handling, is described in Compliance.
2. Infrastructure Security
We use modern cloud infrastructure and security controls appropriate for the Services we provide.
These measures include:
- Encryption in transit using HTTPS/TLS
- Encryption at rest for stored objects and databases where supported
- Network isolation between public and private components
- Managed, access-restricted databases and caches
- Automated infrastructure provisioning, so configuration is reviewable and reproducible
- Security monitoring and alerting
Infrastructure providers remain responsible for the physical security of their facilities. Our providers are listed in Subprocessors.
3. Authentication
Authentication is handled by a specialist identity provider rather than by credentials we store ourselves.
Controls include:
- Secure credential storage and password hashing, managed by our identity provider
- Multi-factor authentication, which we recommend all users enable
- Single sign-on for enterprise customers
- Session management, expiry, and revocation
- Authentication event logging
- Account recovery procedures
Users are responsible for protecting their own credentials.
4. Access Control
Access to production systems is restricted based on business need.
Access is granted using the principle of least privilege, is tied to named individuals, and is reviewed periodically and on role change or departure.
Administrative actions are logged for auditing and operational purposes. Access to customer content is limited to what is necessary to operate the Services, respond to a support request, or investigate a suspected policy violation or security incident.
5. Encryption
Where appropriate, we use industry-standard encryption to protect customer data:
- TLS for all data in transit, including traffic to model providers
- Encryption at rest for object storage and databases
- Encrypted, access-controlled secret management for credentials and API keys
- Signed, expiring URLs for access to stored media
6. API Key Security
API keys authenticate requests on your behalf and should be treated as credentials.
- Keys are shown once at creation and stored by us only in hashed form.
- Keys can be revoked at any time from your account, and revocation takes effect immediately.
- Keys are scoped to a workspace.
- Key usage is logged.
Never embed API keys in client-side code, mobile applications, or public repositories. If you believe a key has been exposed, revoke it immediately and contact us.
7. Monitoring
We monitor our infrastructure to help detect:
- Service failures and degradation
- Security events
- Abuse and anomalous usage patterns
- Unauthorized access attempts
- Infrastructure health issues
Monitoring data may include logs, metrics, traces, error reports, and audit records. Monitoring is configured to avoid capturing customer content where practicable.
8. Backups
We maintain backups intended to support recovery from operational failures.
Backup frequency and retention vary depending on the system. Backups are encrypted and access-restricted.
Backups are intended for disaster recovery. They are not a substitute for exporting and retaining your own copies of content that matters to you.
Content you delete is removed from active systems promptly and purged from backups within 90 days.
9. Incident Response
If we become aware of a security incident affecting customer data, we will:
- Investigate and determine the scope and impact
- Contain the incident where reasonably possible
- Restore affected services
- Notify affected customers and the relevant supervisory authorities where required by applicable law, including the notification obligations under India's DPDP Act and the GDPR
- Implement measures intended to reduce the likelihood of recurrence
- Publish a summary for incidents with material customer impact
Service disruptions are communicated as described in Status & Incident Communication.
10. Vulnerability Management
We regularly:
- Apply software and dependency updates
- Monitor advisories for the components we run
- Review and address known security issues
- Improve security controls as the platform evolves
Critical vulnerabilities are prioritized for remediation ahead of feature work.
11. Responsible Disclosure
We welcome reports from security researchers.
Report to: security@inferon.ai
Please include:
- A description of the issue and its potential impact
- Steps to reproduce
- A proof of concept where appropriate
- Any relevant logs, requests, or screenshots
- How we can reach you
What We Ask
- Give us a reasonable opportunity to investigate and remediate before disclosing publicly.
- Do not access, modify, or delete data belonging to other users. Use your own test account.
- Do not degrade the Services. No denial-of-service testing, spam, or brute-force attacks against live systems.
- Do not use social engineering, phishing, or physical attacks against our staff or infrastructure providers.
- Do not exfiltrate data. Demonstrate the issue with the minimum access necessary and tell us what you accessed.
What We Commit To
- We acknowledge reports within 5 business days.
- We provide an assessment and expected remediation timeline within 10 business days.
- We keep you informed of progress and tell you when the issue is fixed.
- We will not pursue legal action against researchers who follow this policy in good faith.
- We credit reporters who wish to be credited.
We do not currently operate a paid bug bounty program.
Out of Scope
Reports concerning missing best-practice headers without demonstrated impact, rate limiting on unauthenticated endpoints, self-XSS, output from automated scanners without validation, vulnerabilities in third-party services we do not control, and social engineering are generally out of scope.
12. Customer Responsibilities
Security is shared. Customers are responsible for:
- Protecting account credentials and using strong, unique passwords
- Enabling multi-factor authentication
- Keeping API keys secret and rotating them if exposed
- Managing workspace membership and removing members who no longer need access
- Keeping their own devices and browsers secure
- Reviewing generated or uploaded content before sharing it
- Complying with applicable laws
13. Security Updates
Security practices evolve over time.
We may update this Security Policy to reflect improvements to our infrastructure, processes, or legal obligations. The "Last Updated" date indicates the latest revision.