/ legal · security

Security Overview

One page, for procurement and security review. Questions: security@inferrex.com.

At a glance

Tenant isolation — enforced in the database, not only in application code.
Encryption — in transit and at rest, on every tier, never a paid add-on.
Residency — EU by default, UK available, and sovereign or air-gapped inside the customer's own boundary.
Access — customer sign-in through their identity provider; staff access is two independent layers.
Evidence — an append-only audit trail, and a certificate when data is deleted.
Inference — Inferrex's own models. No external model on a sovereign or air-gapped deployment.

The sections below are the same facts, written for a review.

Every tenant-scoped table is protected by PostgreSQL row-level security, enforced at the

database — not only in application code. Isolation is verified with cross-tenant probe

tests as part of the platform's release checks.

In transit: TLS on every external surface; internal service-to-service traffic runs

over a private ingress path that is not internet-routable.

At rest: Azure storage-level encryption for the database and object storage;

customer connection credentials are additionally envelope-encrypted per tenant before

storage.

Encryption is baseline across every deployment tier — it is never a paid add-on.

Customer sign-in via Microsoft identity (MFA delegated to the identity provider);

sovereign deployments own their identity end-to-end (SAML/OIDC).

The admin surface sits behind Cloudflare Zero Trust Access and staff identity —

two independent layers.

Secrets live in Azure Key Vault with purge protection; services access them through

managed identities. CI deploys authenticate with OIDC federation — no long-lived cloud

keys in the pipeline.

Cloudflare fronts every public surface: WAF, bot management, and DDoS absorption at the

edge. Origin infrastructure accepts traffic only through an authenticated tunnel — there

is no directly internet-routable origin.

Platform health alerts page the operator through independent Azure and Cloudflare

signals, and every alert also feeds status.inferrex.com — a public status page that

probes the platform from outside its own infrastructure every two minutes.

Point-in-time database restore is standing (managed PostgreSQL).
Deletion produces a verifiable deletion certificate; audit trails are append-only.
Data residency: EU (Azure West Europe) by default, UK available; sovereign and

air-gapped deployments keep all data inside the customer's boundary.

Models are Inferrex's own, served inside Inferrex's infrastructure. Training uses

structural metadata only (field names, types, shapes) — never customer record content —

and per-tenant contribution is off by default, opt-in per the DPA. The only external

AI provider is an off-by-default emergency fallback (see Sub-processors), never enabled

for sovereign or air-gapped deployments.

The platform is generated from declarative manifests with CI gates on every change:

type checks, test suites, generated-artifact drift checks, and schema migrations that

are append-only and reviewed. Every deploy ships one immutable version across all

services together.