SECURITY · TRUST CENTER
Security is not a feature. It's the foundation.
Tenant isolation, encryption at rest and in transit, immutable audit logs, and compliance-ready evidence collection — built in from day one.
Internally verified May 2026 · ~9.3/10 internal assurance · 18/18 internal security controls verified
- Tenant isolation + RLS
- Row-Level Security on core tables
- ISO 27001:2022 certified
- Ranalysis · EGAC-accredited
- GDPR & DPDPA
- Privacy by design
- Healthcare-ready
- BAA on request
Information Security Management System
Certificate no. DA994C53 Certified on 9 Oct 2026 Valid until 8 Oct 2029 (annual surveillance)
View certificate (PDF)Quality Management System
Certificate no. 834EA3E4 Certified on 9 Oct 2026 Valid until 8 Oct 2029 (annual surveillance)
View certificate (PDF)ISO 27001:2022 and ISO 9001:2015 Certified
Infronest Technology Private Limited is certified by Ranalysis Certification Pvt. Ltd. (EGAC-accredited) for information security management and quality management. Certificate numbers are public — verify them with the certification body.
- Certified organisation
- Infronest Technology Private Limited
- ISO 27001:2022
- Information Security Management System · Certified
- ISO 9001:2015
- Quality Management System · Certified
- Certification body
- Ranalysis Certification Pvt. Ltd.
- Accreditation
- EGAC accredited (No. 012318) · IAF MLA
- View certificate (PDF)
- ISO 27001:2022 and ISO 9001:2015
- Certification scope
- (as printed on both certificates): Design, development, hosting, sale and support of the Infronest cloud-based SaaS platform, including its associated agents and applications, software development, managed IT support and AMC services, vulnerability assessment and penetration testing (VAPT), and cloud and DevOps services. It covers our management systems; it complements your own audits and our internal security assessment, and it is not a penetration test.
Every control, explained
Expand each category for technical detail and a ready-to-read client talking point. All controls below are live in production.
- Authentication & access — 7 controls
- Multi-layer login protection — CAPTCHA, 2FA, secure cookies, and account lockout enforced server-side.
- RBAC & identity — 5 controls
- Seven built-in roles with tenant-scoped permissions. Enterprise adds SSO/SAML and SCIM provisioning.
- Tenant isolation — 6 controls
- Defense in depth — subdomain routing, application-layer scoping, and PostgreSQL Row Level Security on 10 core tables.
- Encryption — 5 controls
- TLS 1.3 in transit, per-tenant Fernet data keys at rest, and optional AWS KMS envelope encryption.
- Audit & monitoring — 5 controls
- Three-layer audit trail — auth events, cross-module activity, and record change history. Append-only, exportable.
- Compliance & privacy — 6 controls
- In-app Compliance Center, DSR handling, consent tracking, and automated data erasure — GDPR/DPDPA aligned.
- Continuous assurance — 6 controls
- Automated security checks on every release — smoke tests, dependency scans, header audits, and internal assessment.
- Operations & incidents — 6 controls
- Documented incident response, access reviews, vendor management, and operational transparency.
Authentication & access
Server-enforced TOTP 2FA
Privileged roles (Owner, Super Admin, Admin) must complete TOTP verification before receiving a session. JWT is withheld until 2FA passes.
TELL YOUR CLIENT “Your admins cannot skip two-factor authentication — it is enforced by the server, not optional in settings.”
JWT httpOnly cookies
Session tokens stored in httpOnly, Secure cookies — not accessible to JavaScript, reducing XSS token theft risk.
TELL YOUR CLIENT “Login sessions use industry-standard httpOnly cookies instead of browser storage that malware can read.”
CSRF protection
Dedicated CSRF token endpoint; state-changing API requests require a valid token. Verified in automated smoke tests.
TELL YOUR CLIENT “Cross-site request forgery is blocked — every write action needs a fresh anti-CSRF token.”
Login CAPTCHA (Cloudflare Turnstile)
CAPTCHA gate on login when enabled. Automated tests confirm login without token returns captcha_required.
TELL YOUR CLIENT “Bot and credential-stuffing attacks hit a CAPTCHA wall before they can attempt passwords.”
Account lockout (django-axes)
Repeated failed login attempts trigger temporary account lockout with configurable thresholds.
TELL YOUR CLIENT “Brute-force password attacks automatically lock the account after too many failures.”
API rate limiting
Rate limits on authentication and sensitive API endpoints to throttle abuse and enumeration.
TELL YOUR CLIENT “Automated abuse is throttled at the API layer — not just the login form.”
Active session management
Users can view active sessions and revoke individual sessions or all sessions from settings.
TELL YOUR CLIENT “If a laptop is lost, your team can kill that session instantly without resetting everyone's password.”
Your data, your control
Clear answers to the questions every IT lead asks before signing.
Where is data stored?
AWS Mumbai (ap-south-1) primary. Backup replication to Singapore. Data residency options available on Enterprise.
Can I export everything?
Yes. One-click export for every module — CSV, JSON, PDF. No vendor lock-in. We make it easy to leave (we just hope you don't).
What happens when I cancel?
90-day data retention. After that, hard delete with cryptographic erasure. Final export available anytime in those 90 days.
Do you train AI on my data?
Never — no AI training, no analytics sharing, no third-party data sales. The optional AI assistant is the only feature that sends anything outside your workspace, it is off unless your admin turns it on, and it sends operational metadata only — never secrets, credentials or file contents.
What does the AI assistant send?
Only if you switch it on. It sends your workspace name, the requesting user's role, your pipeline integration names and the last few pipeline runs and deployments — so it can answer questions about them. No credentials, no vault entries, no customer files, no ticket contents. Off by default for every workspace; an owner or admin must enable it and can revoke it at any time.
What is the uptime SLA?
99.9% on Growth, 99.99% on Enterprise when contracted. Live operational status is published on our public status page when configured.
How do you handle incidents?
Public status page, email + Slack alerts, post-mortem within 5 business days. Breach notification within 72 hours per GDPR/DPDPA.
Automated verification
- These checks run in production and CI — not marketing claims.
- run_diy_security_checks — PASS (May 2026)
- run_security_smoke_tests — CSRF + CAPTCHA gate verified
- check_tenant_isolation — null-org audit + RLS cross-tenant probe
- audit_security_headers — HSTS, CSP, X-Content-Type-Options
- Login without CAPTCHA token — returns captcha_required
- Backup restore drill — PASS with RTO/RPO logged
- Dependency SCA — pip-audit + npm audit in CI
- Internal assessment — no Critical/High in automated checks
- Security controls — 18/18 items verified internally
- Access review Q2 2026 — Platform Owner sign-off
- Verified via automated smoke tests, tenant isolation checks, and internal security assessment. Our ISO 27001:2022 / ISO 9001:2015 certification audits (Ranalysis Certification, October 2026) are separate — neither is a penetration test.
Honest boundaries — what we do not claim
- ISO 27001:2022 / ISO 9001:2015 certify Infronest Technology Private Limited (management-system scope, October 2026) — not a per-tenant attestation for your own audit
- No third-party penetration test completed — internal assessment only (May 2026)
- CAPTCHA uses Cloudflare Turnstile — production keys should replace test keys before customer-facing claim
- Manual cross-tenant browser tests recommended for final Enterprise sign-off
- Formal 10/10 score requires external auditor engagement (months + budget)
- Claims reflect controls verified in our internal security assessment (May 2026) and our ISO 27001:2022 / ISO 9001:2015 certification (Ranalysis Certification Pvt. Ltd., October 2026). A third-party penetration test is available on Enterprise RFP timeline.
Sales FAQ — client questions
Copy-ready answers for security questionnaires and procurement calls.
Need a security review?
Request our security overview, DPA, and audit readiness summary.