Compliance
SOC 2 Type II
InfraStack AI, Inc. holds a SOC 2 Type II report. It is available on request.
Request the reportHow we protect your data
Product
- Every Slack workspace gets its own InfraStack agent in an isolated environment with its own storage.
- InfraStack reads and reports. It never logs in to, scans or changes your systems.
- GitHub access is read-only. We don’t copy or keep your codebase; we keep findings, not source.
- In channels it acts only on messages that mention it.
Data
- Encrypted in transit and at rest, including Slack and GitHub access tokens.
- Stored in the United States.
- Files from the setup form expire after 60 days.
- Delete account removes the agent, its storage, your files and your records; backups age out within 7 days.
AI
- Models run within our own cloud environment in the United States.
- Nobody trains AI models on your information: not us, and not the model provider.
- Each workspace’s agent sees only that workspace’s files and notes.
Infrastructure
- Customer workloads run isolated from each other, with no direct internet access.
- Secrets are kept out of code and injected at runtime.
- Databases are backed up daily with point-in-time recovery.
- Service status is public on our status page.
Access
- Production access is limited to the people who run the service.
- Changes ship through automated builds and deploys.
Details are in our Privacy Policy and Terms. Live service status: status page.
Controls
The controls in our SOC 2 program that apply to InfraStack today.
Application security
- Web application firewall
- DDoS protection
- Software development lifecycle
- Vulnerability management
Data security
- Daily database backups
- Encryption at rest
- SSL/TLS enforced
- Restricted cloud data storage
Infrastructure security
- No public SSH
- Firewalls and network isolation
- Application servers across availability zones
- Logging and alerting
Access control
- System access control policy
- Unique accounts
- MFA on accounts
- Password policy
Organization
- Security policies
- Acceptable use policy
- Code of conduct
- Security training
- Incident response plan and team
- Business continuity and disaster recovery plans
- Internal and external communication channels
Endpoint security
- Hard-disk encryption
Subprocessors
The service providers that process data for InfraStack, and what each does.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, databases and AI processing | United States |
| Cloudflare | DNS, TLS and network protection for infrastack.ai | Global |
| Slack | Where InfraStack works, under your organization’s own terms with Slack | United States |
| Exa | Web search for the agent: search terms and public page addresses only, never your files | United States |
| Browserbase | Hosted browser for reading public pages that need JavaScript | United States |
| PostHog | Analytics for infrastack.ai | United States |
| GitHub | Reading the repositories you choose, read-only, if you connect it | United States |
| Google Workspace | Our email | United States |
Requests and vulnerability reports
Ask for our SOC 2 report, send a security questionnaire, or ask anything about how we handle your data. It goes straight to the team that runs InfraStack.
Found a vulnerability in InfraStack? Choose Report a vulnerability. We investigate every report, keep you updated, and won’t pursue good-faith research that avoids harm to our users and their data.