Skip to content
Beta Every feature free, no card.

A network map is a list of what to attack.

Infrality is a tool for people who audit networks for a living, so it is reasonable to expect us to answer this page well. Here is what we do, and how to tell us when we have got something wrong.

Reporting a vulnerability

Email [email protected] with enough detail to reproduce the issue. We acknowledge within 72 hours, tell you our assessment within 10 working days, and keep you updated until it is fixed. Please give us 90 days before publishing, and we will credit you when we announce the fix unless you would rather we did not. security.txt

What we do

Credentials

  • Passwords hashed with bcrypt at cost factor 12 — never stored or logged in clear
  • A 12-character minimum with mixed character classes, enforced in one place server-side
  • API keys, password-reset tokens, verification tokens and recovery codes stored only as SHA-256 hashes
  • Sign-in lockout after repeated failures, and a per-account cooldown on every email we send

Authentication

  • Two-factor authentication with an authenticator app, a security key (WebAuthn/FIDO2) or an emailed code
  • Ten single-use recovery codes, accepted as a fallback for every factor
  • Short-lived access tokens with rotating refresh tokens; a reused token revokes every session for that account
  • Re-authentication required for destructive actions — deleting an account, changing a password, removing a factor — not just a live session
  • Sign-in with Google, GitHub and Microsoft, which never links an account on an address the provider has not verified

Your organization

  • Prove your email domains by DNS, then sign your people in through your own identity provider over OIDC or SAML
  • Provision and deprovision people and teams from your directory with SCIM 2.0; deprovisioning someone on your domain ends every session they have
  • Require an authenticator app or a security key, cap session length and idle time, and allow only your address ranges — for people and for agents
  • Every change of access recorded, exported as CSV or JSON, or streamed to a webhook or syslog; retention you choose
  • Export the whole organization as one file; deleting it is an owner’s decision with a 30-day grace period

Your data

  • TLS on every connection; device descriptions and runbooks encrypted at rest with AES-256-GCM
  • Cross-organization access denied by default through a single authorization layer
  • A resource you cannot see answers the same way whether or not it exists, so ids cannot be probed
  • Tenant-isolation cases in an automated suite that runs on every change, each one proven to fail when its guard is removed
  • Imported files are read in your browser and never uploaded; Infrality holds no credentials to your systems

The agent

  • Runs as its own unprivileged account holding one capability, CAP_NET_RAW, inside a systemd sandbox on Linux
  • Connects out to Infrality; it opens no port on your network
  • Releases signed: the installer checks the manifest’s signature against a pinned key before trusting any checksum
  • Authenticates with its own key, bound by default to the first agent that uses it; an admin can pause it, change what it sweeps or remove it from the dashboard

Infrastructure

  • Hosted in France; data and backups do not leave the European Economic Area
  • Default-deny firewall, key-only SSH with passwords and root login disabled, automatic security updates
  • Deployment credentials confined by a forced command to one directory and one action
  • A database dump taken before every deployment, with an automated health check and rollback
  • Automated dependency updates, secret scanning and vulnerability scanning in CI

Scope

In scope: infrality.io, www.infrality.io, api.infrality.io, app.infrality.io, and the Infrality agent.

Please do not: run denial-of-service or volumetric tests, use automated scanners that degrade the service for others, attempt social engineering against us or our providers, or access, modify or delete data belonging to anyone else. Use your own account and your own test data. Stay within those lines and we will not pursue you for a good-faith report.

We do not run a paid bug bounty. We are a small team and would rather be honest about that than imply a reward we cannot pay.

Breaches

If a breach affects personal data and is likely to put anyone's rights at risk, we notify the CNIL within 72 hours of becoming aware, and affected people directly where the risk is high. Customers whose data we process are told within 48 hours so they can meet their own obligations. See the Privacy Policy and the Data Processing Agreement.