The short version:
- We don’t copy or keep your codebase. With GitHub connected, InfraStack reads the files it needs in place, read-only, and keeps its findings, not your source. Files you choose to share with it, like a lock file or Terraform, are kept only so its agent can check them, and Delete account removes them.
- InfraStack acts on what you share with it: messages that mention it, files you give it, and what you tell it about your stack.
- Each workspace gets its own isolated agent with no direct internet access.
- It reads and reports. It never logs in to, scans or changes your systems.
- AI runs within our own cloud environment. Nobody trains models on your data.
- We don’t sell your information or use it for ads.
- Delete account removes everything: the agent, its storage, your files and your records.
1. Who we are
InfraStack is a security assistant that lives in Slack. It tracks new vulnerabilities, exploits, vendor incidents and attacks on AI coding agents, checks them against the stack you describe or share, and tells your team which ones affect you. It is operated by InfraStack AI, Inc. (“InfraStack”, “we”, “us”). This policy covers the InfraStack service, the Slack app, and infrastack.ai.
2. Information we collect
We collect what InfraStack needs to check your stack and talk to your team.
- Your Slack workspace: its name and ID, the ID of the person who installed InfraStack, the channels InfraStack is added to, and the access token Slack issues to the app.
- Messages in channels where InfraStack is added that mention it, and direct messages you send it. When you mention it in a thread, it reads that thread for context. It does not act on other conversations in your workspace.
- Files you share with InfraStack, in Slack or in the setup form: lock files, Dockerfiles, infrastructure code, documents. We keep them exactly as uploaded.
- What you tell InfraStack about your stack and your company, and the notes its agent keeps from that: the components you run, the findings for each threat, open questions, and schedules you set.
- The domain of the installer’s work email address, read once at install to learn which company the workspace belongs to. We keep only the domain, never the full address, and we ignore free email providers such as Gmail or Outlook.
- If you sign in to infrastack.ai with Slack: your name, email address and Slack user ID.
- If you connect GitHub: read-only access to the repositories you choose. InfraStack reads the files it needs in place and keeps its findings, not your source; we never clone or keep a copy of your codebase.
- Usage information such as the threads and scans per workspace, and basic analytics on infrastack.ai (see Cookies and analytics).
3. How we use it
- To provide InfraStack: understand your stack, check new threats against it, answer your questions, run the scans and reports you schedule, and post the results in Slack.
- To read public information about your company and products, such as your website and public security pages, so findings reflect what you run and what you promise your customers.
- To keep the service secure, prevent abuse, and fix problems.
- To improve InfraStack, using aggregated or de-identified information.
- To meet legal obligations and enforce our terms.
We do not sell your information, and we do not use it for advertising.
4. Your workspace’s agent
Each Slack workspace gets its own InfraStack agent, running in its own isolated environment with its own storage. One workspace’s agent cannot reach another workspace’s files or notes, and it has no direct access to the internet.
The agent reads public web pages (advisories, vendor security pages, your public website) to verify what it tells you. It does not scan, probe or log in to your systems, and it never changes anything in them.
5. AI processing
InfraStack uses large language models to read what you share and produce its answers. The models run within our own cloud environment in the United States; your messages, files and notes are not sent to an outside AI company.
Nobody trains AI models on your information: not us, and not the provider of the models. Information goes to a model only for as long as it takes to produce an answer.
6. Who receives your information
We use service providers to run InfraStack, and each receives only what its job needs:
- Cloud hosting, storage and AI processing, in the United States.
- Network, DNS and security protection for infrastack.ai.
- Slack, where InfraStack works, under Slack’s own terms with your organization.
- Web search and browsing services, which receive only the search terms and public page addresses the agent looks up, never your files.
- Website analytics for infrastack.ai.
- Code hosting, if you connect it, to read the repositories you choose.
- Email and business tools.
We may also disclose information when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to apply.
8. Storage, retention and deletion
Information is stored in the United States. Files from the setup form are kept in encrypted storage and deleted automatically after 60 days; the agent keeps its own copy and its notes until your account is deleted.
Deleting your account from the dashboard removes InfraStack from your Slack workspace and deletes your workspace’s agent, its storage and notes, every uploaded file, and your workspace’s records in our databases. Database backups that still contain them age out within 7 days.
Removing the app from Slack stops InfraStack’s access but does not by itself delete what we hold. To delete it, use Delete account on the dashboard or write to [email protected].
9. Security
Data is encrypted in transit and at rest, including the access tokens for Slack and GitHub. Each workspace’s agent is isolated as described above, and access to production is limited to the people who run it. InfraStack AI, Inc. holds a SOC 2 Type II report, available on request.
10. Your choices and rights
You can see what InfraStack knows about your stack by asking it in Slack, correct it in words, and delete everything with Delete account. Depending on where you live, you may also have the right to access, correct, delete or export personal information, and to object to or restrict its processing. Write to [email protected] and we will respond within 30 days. We will not treat you differently for using these rights.
11. Children
InfraStack is a service for businesses and is not directed to children under 16.
12. Changes to this policy
When we change this policy we post the new version here with a new effective date. For material changes we tell the workspaces that use InfraStack before they take effect.
13. Contact
Questions or requests about privacy: [email protected]. InfraStack AI, Inc.