Security & Compliance

Infinex AI is used by product, marketing, and customer-success teams to automate video production at enterprise scale. We treat every prompt, upload, face recording, and voice sample as sensitive data. This page documents the controls we have in place today, and what is on our compliance roadmap.

Access & identity

• SSO — SAML 2.0 with Okta, Azure AD / Entra ID, Google Workspace. Available Q1 2027 · currently in build.
• SCIM 2.0 provisioning — automatic user create / update / deprovision from your IdP. Ships alongside SSO.
• Multi-factor authentication — Google Sign-In today; TOTP/passkeys on the roadmap.
• Role-based access — admin vs user in production. Workspace-level roles ship with SSO.

Encryption

• In transit — TLS 1.3 on every endpoint (frontend, API, media CDN). Enforced by Cloudflare and Railway. No plaintext traffic accepted.
• At rest — AES-256 on Postgres (Railway managed) and on Cloudinary media storage.
• Passwords — hashed with Argon2id, never stored in plaintext or reversibly.
• API keys / tokens — server-side only, rotated on-demand.

Audit logging

• Every state change (create, delete, approve, admin action) is written to a dedicated AuditLog table.
• Records include actor, target, action, timestamp, and IP.
• Retention: 90 days rolling. Exportable as CSV from /account/audit-log (UI in build; endpoint live).

SOC 2 Type II

We are in the process of preparing for our first SOC 2 Type II audit. Target completion: Q3 2027. Interim controls are already implemented (encryption, access controls, incident-response process, vendor review). Enterprise customers can request our current readiness state under NDA.

GDPR & DPA

• Data Processing Agreement — available on request. See /legal/subprocessors for our current list of sub-processors.
• Personal-data inventory — maintained internally as required by GDPR Article 30 (extract available under NDA).
• Data subject rights — access, rectification, erasure, and portability supported from /account. Manual requests: support@infinexai.io, 30-day turnaround.
• EU data residency — available on request. Railway supports EU-region deployment.

Biometric consent (custom avatars & voice clones)

Custom avatars and voice clones are considered biometric data under GDPR Article 9. Before generating any custom avatar or voice, the subject (the person being cloned) must sign a digital consent form. The consent record is timestamped, IP-logged, emailed as PDF to the signer, and linked to every generated asset in our database.

HeyGen's own verification workflow additionally enforces face-match identity checks for custom avatar training.

Incident response

• Detection: Sentry, Datadog uptime alerts, Cloudflare firewall notifications.
• Notification: affected customers are informed within 72 hours of confirmed incident (GDPR Article 33).
• Post-mortem: public write-up within 7 business days for incidents affecting more than one customer.

Data retention & deletion

• Account content: retained for the life of the account, or until user-initiated deletion.
• Backups: rolling 90-day window.
• Billing records: retained 7 years for tax compliance.
• After account deletion: all data, including sub-processor content, is scheduled for permanent removal within 30 days.

Reporting a vulnerability

We take responsible disclosure seriously. If you find a security issue, please email support@infinexai.io with a description of the finding. We aim to acknowledge within 48 hours. Please do not publicly disclose the issue until we have had a chance to address it.