Security

1. Where we stand

InfraMap is early-stage and independently run. We do not have a SOC 2 report or another security certification yet. We plan to pursue SOC 2 and are building our controls with it in mind. When a report exists, we will share it with customers under a nondisclosure agreement.

Our main hosting, payment and AI providers maintain independent security certifications, such as SOC 2 reports and, for Stripe, PCI DSS Level 1.

2. Infrastructure and encryption

• InfraMap Pro, the MCP server and inframap.org run on Amazon Web Services in the United States (US East), served through Amazon CloudFront. InfraMap Edu runs on DigitalOcean. Data is stored in the United States. See the subprocessor list.
• The application servers accept traffic only through our CloudFront distribution. Administrative access goes through AWS Systems Manager, not SSH.
• All traffic to InfraMap uses HTTPS.
• Our infrastructure providers encrypt stored data at rest.
• Account and application records sit in private storage that is not publicly addressable.

3. Accounts and sign-in

• Customers sign in with Google or with a one-time email code that expires after 10 minutes and is stored only as a keyed hash. Customer accounts have no passwords. A few reviewer accounts that we configure can sign in with a password.
• Sign-in attempts are rate limited.
• Session cookies are signed, HttpOnly, Secure and host-only, and last 30 days.
• For MCP sign-in, refresh tokens are stored hashed and rotated on use, and access tokens expire after one hour.
• Stripe handles card data. We never see or store full card numbers.

4. Data minimization

• InfraMap Pro analytics record a defined list of events. Automatic click capture and session recording are off.
• Analytics and conversation records use random identifiers, not account identities.
• Global Privacy Control and Do Not Track turn off InfraMap Pro analytics.
• MCP server logs record tool names, outcomes, timing and output size, not arguments or results.
• Our AI model providers process requests under commercial terms that do not allow training on our data.

5. Internal access

• Production access is limited to a small number of authorized team members.
• Secrets live in AWS Systems Manager Parameter Store as encrypted values and in our hosting providers' encrypted environment settings, not in source code.
• Code changes go through version control, pull requests and automated checks before release.

6. Incident response

If we learn of a security incident that affects your personal information, we will investigate, contain it, and notify affected users and regulators as the law requires. Enterprise customers receive notice as their agreement specifies.

7. Reporting a vulnerability

Email contact@inframap.org with "Security" in the subject line. Include the affected address, steps to reproduce and the impact you observed. We will acknowledge your report and keep you updated.

We will not pursue legal action against good-faith research that follows these rules:

• Access only the data you need to show the issue, and never other users' data.
• Do not degrade the Services, run denial-of-service tests or use automated scanners at high volume.
• Do not use social engineering, phishing or physical attacks.
• Give us reasonable time to fix the issue before you disclose it publicly.

Our security contact is also published at /.well-known/security.txt.