Security
Inficy holds records of what your agents did, so its own controls are stated plainly rather than implied by a badge.
Tenant and workspace isolation
Every execution, action, artifact and credit entry belongs to a workspace, and isolation is enforced at the database layer with row-level security rather than in application code alone. A query that omits its workspace scope returns nothing rather than another tenant's data.
Access controls
Access requires an authenticated account, and privileged operations verify the caller's workspace role on the server. Administrative tooling is restricted to platform operators and records an audit event.
Agent credentials
Connection tokens and one-time setup credentials are scoped to a single agent, shown once at creation, stored only as keyed hashes, and revocable at any time. Ingestion authenticates the credential before it looks at anything else in the request, and rate limits apply per workspace and per agent so one noisy agent cannot exhaust a workspace's capacity.
Evidence storage and integrity
Canonical artifacts are stored privately at content-addressed paths in a bucket with no public or end-user access; all reads are mediated by the server after an authorisation check. Artifacts are verified offline against the NexArt SDK before an execution is marked verified, and once a verified canonical artifact is sealed onto an execution, replayed ingestion cannot alter its recorded metadata. Executions whose artifact fails verification stay visible, are clearly marked, and can never be certified.
Confidential executions
Protected values can be represented by NexArt confidential commitments. The private disclosure (opening) material remains with you as the data owner and is not sent to Inficy by default, so we cannot reconstruct hidden values. Confidential is not anonymous: the execution, workspace and agent remain identified.
Certification is optional
Recording stays inside the Inficy capture and storage path. A canonical artifact is only submitted to a NexArt Node when you deliberately request certification of that specific execution.
Audit and monitoring
Security-relevant actions, credential issuance and revocation, machine registration approvals, spending mandates and operator actions, are recorded in an audit log, and operational counters are monitored for abnormal ingestion patterns.
Pilot status
Inficy is in an invited pilot. Workspaces are single-operator today; there is no invitation or shared-access flow yet. We have not completed an external security audit, and we hold no SOC 2 or ISO 27001 certification, we do not claim either.
Responsible disclosure
Report suspected vulnerabilities to contact@artnames.io before disclosing publicly, with reproduction steps. We aim to acknowledge receipt within 2 business days and will keep you updated until the report is resolved. We will not pursue legal action for good-faith research that respects other tenants' data and avoids service degradation. This page is the policy referenced by /.well-known/security.txt.