Legal
Security
Last updated
An overview of how the Service is protected. Detailed control documentation and completed security questionnaires are available to customers and evaluators on request. The vulnerability-reporting process is at the end.
Encryption
All traffic is served over HTTPS, with browser hardening headers on every response. Application data is encrypted at rest and in transit.
Accounts and API keys
Passwords and API keys are stored only as one-way hashes, so neither can be read back, even by us. A lost password is reset, not recovered. Sessions are signed and expire, and repeated failed sign-ins are throttled. API keys can be revoked and reissued at any time — email admin@infinidatum.net.
Payments
Card data never touches our systems. Checkout is hosted by Stripe, a PCI-DSS Level 1 service provider, and we receive only confirmation that a payment completed.
Data handling and access
The Service holds no consumer financial data and no member-level records; it analyzes institutions. The most sensitive subscriber data we hold is a name, an email and a plan. Production access is limited to the people who operate the Service, and secrets are kept out of source code.
Security reviews
If your procurement process requires a security questionnaire or control documentation, email admin@infinidatum.net and we will complete it before you contract.
Reporting a vulnerability
Email admin@infinidatum.net with “Security disclosure” in the subject line, including what you found and how to reproduce it. We acknowledge reports within two business days, and we will not pursue legal action against good-faith research.
In return, please use your own test account, do not access or modify anyone else’s data, do not run denial-of-service or social-engineering tests, and give us a reasonable window to fix an issue before you publish it.
Incident response
If a breach affects personal information we hold, we notify affected users and the applicable regulators on the timeline set out in section 8 of the Privacy Policy.