Enterprise-grade security, by default
Security is not a feature at INFYNAX — it's the foundation. From the way we store your data to how we handle access control, every layer is hardened to protect your business and your customers.
Industry certifications
SOC 2 Type II
Independently audited annual report covering Security, Availability, and Confidentiality trust service criteria.
GDPR Compliant
Full compliance with the EU General Data Protection Regulation. DPA available on request.
ISO 27001
Information Security Management System (ISMS) certified to the international ISO/IEC 27001:2022 standard.
Infrastructure
INFYNAX runs on AWS infrastructure across multiple availability zones for maximum redundancy and low latency delivery worldwide.
- Multi-region AWS deployment (US, EU, APAC)
- 99.9% uptime SLA with financial credits
- Automated daily backups with 30-day retention
- Point-in-time recovery for databases
- DDoS mitigation via AWS Shield Advanced
- CDN-accelerated API endpoints globally
Data Security
Your data is encrypted in transit and at rest. We use industry-standard algorithms and rotate keys regularly.
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest
- Encrypted database backups
- No plaintext credential storage — bcrypt hashing
- Role-based access control with least privilege
- API keys scoped by workspace and permission level
Compliance & privacy
GDPR
- Data Processing Agreements (DPA) available
- Right to erasure ("forget me") API
- Data portability export
- EU data residency option
CCPA
- California Consumer Privacy Act compliant
- Opt-out of data sale (we never sell data)
- Consumer rights request portal
- Annual privacy disclosure
WhatsApp Business Policy
- Opt-in only messaging — no cold outreach
- Meta-approved templates only
- Opt-out management built in
- Policy violation detection and alerts
Access Control
- MFA enforcement (TOTP + WebAuthn)
- SSO via Google OAuth and SAML 2.0
- Session management with idle timeout
- IP allowlisting (Enterprise)
Penetration Testing
- Annual third-party pen test by certified firm
- Continuous automated vulnerability scanning
- Bug bounty programme via HackerOne
- Responsible disclosure policy
Incident Response
- 24-hour breach notification SLA
- Dedicated security incident response team
- Post-incident reports published
- 72-hour regulatory notification where required
Have security questions?
Our security team is happy to answer questions, complete vendor security questionnaires, or provide our latest pen-test report under NDA.