Security

Credentials

• Passwords hashed with bcrypt (cost 12)
• API keys: 192-bit random, stored as SHA-256 only, shown once at creation
• Sessions: HttpOnly, SameSite=Lax, Secure cookies, HS256-signed JWTs
• Logout and password change bump session version and invalidate outstanding tokens

Payments

Cards are processed by Stripe Checkout (PCI DSS SAQ-A) once card payments are enabled. Credits are applied only after a signed Stripe webhook confirms payment. Ledger writes are idempotent per Checkout session. Invoices and hosted receipts are generated by Stripe.

Platform controls

• TLS with HSTS between your application and the gateway
• TLS from the gateway to the GPU when a model is serving, pinned to our own certificate authority and terminating inside the inference process itself. There is no tunnel vendor or reverse-proxy middlebox in that path, and the gateway refuses to send prompts over plaintext to public addresses
• Security headers (CSP, frame-ancestors none, nosniff)
• Per-key rate limits and optional monthly spend caps
• API requests are proxied to the inference backend and never written to our database, only token counts for billing
• Inference engines run with request logging disabled, so prompts don't land in server logs either

Responsible disclosure

Report vulnerabilities to support@infrapriv.comwith reproduction steps. Do not access other customers' data; use your own account for testing.