Infervo← Back to home
Last updated · 28 June 2026

Security

A plain-English summary of how Infervo protects your data during its invite-only preview. For what data is shared with third parties, see the Privacy Policy.

Authentication

Sign-in is via Google OAuth — we never see or store your password. Access is invite-only: only email addresses on our allow-list can create an account.

Encryption & secrets

Traffic is served over HTTPS/TLS. Infervo does not connect to your databases and does notstore database connection credentials. Server-side secrets (such as our API and encryption keys) live in the runtime environment, never in source control, and are scrubbed from any subprocess that doesn’t need them.

How scanning works

A scan runs entirely on our side: an internal scanner service fetches and renders the public website at the URL you submit (in a headless browser) and reads public DNS for its domain. Infervo does not execute anything on your systems and only observes what a normal web visitor would. The scanner refuses URLs that resolve to private, loopback, or cloud-metadata addresses, and runs with bounded concurrency and timeouts.

Tenant isolation

Every project and its scan reports are scoped to your organisation. Requests are authorised against your organisation on every access (tested against cross-tenant access).

Infrastructure

  • Hosted on DigitalOcean; application services run in containers as a non-root user.
  • The scanner is an internal-only service, not exposed to the public internet; backend services are reached only over the private compose network.
  • The Docker socket is not mounted into application containers.

Third-party providers

Infervo runs on the infrastructure sub-processors listed in our Privacy Policy (hosting, Google sign-in, public DNS resolvers, and product analytics). Reports are produced from public website signals and public DNS — no private data of yours is sent to a third party to generate a scan.

Responsible disclosure

Found a security issue? Please email hello@infervo.app with the details and we will respond promptly. Please do not publicly disclose until we have had a chance to fix it.

Preview status

Infervo is in active preview; our security posture is evolving and this page will be kept current.