Security

Certifications

We hold no ISO 27001 certification and no SOC 2 attestation. Neither has been pursued yet, and we would rather state that than describe ourselves as aligned with a standard we have not been audited against.

If a procurement process needs a specific attestation, ask before the pitch so the answer is not a surprise later. We will tell you what we can evidence instead, which is usually the controls below plus whatever your own environment already enforces.

Access control

Access to client systems is granted per engagement, to named individuals, through single sign-on with multi-factor authentication required on every account. No shared logins, and no standing production access for anyone who does not need it that week.

Access is reviewed quarterly and revoked within 24 hours of someone leaving an engagement. We work in your environment under your controls wherever you have them; where you do not, we bring ours and document what they are.

Code and dependencies

Every change is reviewed by someone who did not write it. Dependency and secret scanning run in CI, and builds fail on high and critical findings rather than warning and continuing.

Production access is separated from development access, and deploys are auditable to a person and a commit.

Incidents

If we become aware of a breach affecting your data we will tell you within 72 hours, with what is known at the time rather than after the investigation concludes.

Post-incident reviews are shared with the client, including the parts that reflect badly on us.

Reporting something

If you have found a vulnerability in something we run, write to hello@infinite.dev. We will acknowledge within two business days and we will not pursue anyone who reports in good faith.