Security by Principle, Not by Mandate
Infraveil is not SOC 2 certified because our architecture makes it inapplicable. We designed a system that never sees, stores, or handles your critical data. However, we firmly believe in and have engineered our entire platform around the core Trust Services Criteria that SOC 2 represents. This is our philosophy.
A Deliberate Architecture of Data Isolation
SOC 2 compliance is essential for service organizations that manage customer data. Infraveil operates on a fundamentally different, more private model. We provide a tool that runs on your infrastructure, giving you full control and ensuring we remain completely blind to your data.
The distinction is critical: SOC 2 is an auditing procedure for organizations that are custodians of customer data. It provides assurance that a vendor is handling that data responsibly. Infraveil is architected to never be a data custodian.
Our agent is a self-managing application that executes logic on your server. It is a powerful tool you wield, not a service that holds your information. Since we have no access to the data that our agent processes, we are not a "service organization" in the context of a SOC 2 audit. This is a feature, not a limitation. It gives you the ultimate freedom to build your own security stack and meet any regulatory standard (like HIPAA or GDPR) without being constrained by our policies. The compliance of the system rests where it should: with you, the data controller.
Our Commitment to SOC 2 Principles
While we are not formally audited, we treat the five Trust Services Criteria as the blueprint for our engineering and operational security. Our reputation is built on delivering a service that embodies these principles in practice.
Security
The "Security" principle is the bedrock of Infraveil. Our model is designed to drastically reduce the attack surface. The agent's core logic runs entirely in memory and never touches your disk. It operates as a non-root user, limiting its permissions on your system. By eliminating source code on your server, we remove the single largest vector for exploits and reverse engineering.
Availability
We are committed to extreme resilience. The Infraveil agent is designed for autonomous operation and instant recovery. If your server or the agent process fails, our network immediately provides a new agent for deployment. You can be back online in under 60 seconds with the exact same configuration and logic, ensuring your backend is as available as the infrastructure you run it on.
Processing Integrity
Your backend should do exactly what you designed it to do—nothing more, nothing less. Your agent's application logic is immutable and bespoke. It is engineered specifically for your requirements and will not change unless you explicitly request new features. This guarantees that processing is complete, valid, accurate, timely, and authorized, every single time.
Confidentiality & Privacy
These are not features; they are our founding principles. We architected Infraveil to be physically incapable of violating your data's confidentiality. We do not require KYC and accept crypto-only payments to maximize your privacy. More importantly, the system is designed so that your sensitive data—and even data you don't consider sensitive—never leaves your server for ours. This is not a promise; it's an architectural guarantee.
Verifiable Trust: Our Proof Is in the Logs
We encourage skepticism and provide the tools for you to validate our claims. Our commitment to transparency is absolute and auditable by anyone, at any time. Don't trust our word—verify everything.
Inspect the Audit Log
The Infraveil agent creates a local audit.log file on your server. This log provides a complete, human-readable record of every single piece of metadata that is ever transmitted to our infrastructure. You will see that the only data sent is for license validation (anonymized UUIDs) and anonymous error signals for proactive maintenance. Your application data, API keys, user information, and secrets are never present. You see exactly what we see.
Monitor Your Network Traffic
We invite you to point any network monitoring tool you trust (like Wireshark or tcpdump) at the outbound traffic from the agent. You will confirm that the agent only establishes a secure, minimal-data connection to our core servers. The communication is for fetching its own logic and sending heartbeat signals—not for exfiltrating your business data.
Architectural Proof
Ultimately, our business model itself is proof. The entire system—from configuration via a local config.json file to using a simple reverse proxy—is built around the idea that the logic comes to your server, but your data stays put. This is the foundation of the insurmountable trust we aim to build with every client.