Trust Centre
Jurisdiction you can hold us to
Where your requests are processed, who can reach them, and what we do when an authority asks. Each commitment is written into our Terms and Data Processing Agreement.
Jurisdiction
Your requests stay under the rules you chose
Sovereignty here means a contractual guarantee about where processing happens and who can reach it, not a setting we can turn off to keep traffic flowing.
- 01Terms 6.1
Every request is bound to its region scope
Each API key belongs to a project with a region scope. The request, and the records it creates (identity, metering, routing and audit logs), stay within that scope.
- 02Terms 6.2
Refused, not rerouted
If a request cannot be served within its scope, for capacity, model availability or any other reason, it is refused with an error. It is never served from another region.
- 03Terms 6.7
Access limited to the region
Operational and support access in each region is limited to personnel authorised for that region, on least-privilege terms and logged.
- 04Terms 6.8
Government and legal requests
If an authority asks for your data, we notify you where the law allows, challenge requests that are overbroad or unlawful, disclose only the minimum, and report it in the transparency section below.
- 05Terms 6.6
Evidence you can keep
Where a region offers them, per-request attestation records and signed residency exports are available through the portal and API.
Commitments
What we commit to, in writing
Each commitment is a clause in our Terms or Data Processing Agreement. Follow the reference to read it in full.
Requests stay in scope
Each request is served within the regions its key is scoped to. If it cannot be, it is refused, not sent elsewhere.
Government requests
If an authority asks for your data, we notify you where the law allows, challenge overbroad requests and disclose only the minimum.
Nothing stored
Prompts and outputs are not stored, logged or read, by people or by automated systems.
No training, ever
Your content is never used to train or improve any model, and that cannot be switched on.
Incidents reported within 24 hours
We notify you within 24 hours of a security incident affecting your personal data, and within 4 hours for customers under DORA.
30 days' notice on sub-processors
You are told before any new sub-processor is added, and you can object.
Audit rights
Audit reports, an annual security questionnaire, and the right to audit where your regulator requires it.
Processor terms for data protection law
The DPA serves as the processor contract required under GDPR and other national data protection laws.
Data protection
How your data is protected
Data in transit
Customer content is encrypted in transit using current industry-standard protocols.
Data at rest
Stored objects are encrypted at rest, with keys managed within the region that holds them.
Prompts and outputs
Not retained. Deleted when the request completes; no backup copy is taken.
Backups
Encrypted backups of stored objects and control-plane data run on a rolling 35-day cycle, so deletions reach backups within 35 days.
Integrity controls
The only two controls that touch a stored file
Prompts and outputs are never examined. Stored files rest on our infrastructure, so the Agreement commits to exactly two structural checks, and nothing else. We will describe any change to these controls here.
Compressed-media integrity check
Stored image, audio and video files are compared against cryptographic hash lists of material identified by a competent authority or a recognised child-protection organisation as child sexual abuse material. The comparison returns a match or no match and reveals nothing else about the file.
Malware and unsafe-format scanning
Stored Customer Models, Fine-Tuned Models and uploaded files are scanned structurally for malware and for unsafe serialisation and deserialisation formats.
Limits of both controls
Neither control reads, interprets or retains the substantive content of a stored object. Neither is applied to Inputs or Outputs, and neither is used for any purpose other than the one stated.
Security controls
Technical and organisational measures
The measures we maintain throughout your contract, as set out in the Data Processing Agreement.
Infrastructure security
- Residency controls bind each API key to its region scope and refuse requests that cannot be served within it
- Encryption keys managed within each region
- Logical tenant isolation on shared capacity; physical or virtualised isolation for dedicated capacity
- Confidential-computing execution with per-request attestation, where offered for a region
- Business-continuity and disaster-recovery arrangements for each service mode
Identity and access
- Federated authentication and single sign-on
- Role-based access control
- Re-authentication for sensitive actions
- Immutable audit log of administrative and configuration changes
- Signed residency exports available to customers
Personnel and organisational security
- Least-privilege access for Infinia personnel, logged and reviewed periodically
- Personnel access restricted to the region they are authorised for
- Background verification of personnel, to the extent local law permits
- Identity-verification records kept apart from operational systems
Product security
- Vulnerability management and secure development practices
- Independent penetration testing at least once a year
- Malware and unsafe-format scanning of uploaded models and files
- Security-incident response with defined escalation and notification
Data and privacy
How long we keep data
Every period runs within your region scope. Deleting a stored object takes effect immediately in live systems and within the backup cycle.
Transparency reporting
Government and legal requests
Where the law allows, you hear about a request for your data before we respond to it.
If Infinia or a Zone Operator receives a request or order from a government authority, court or law-enforcement body for Customer Content or Usage Data, we notify you unless legally prohibited, challenge any request we reasonably consider overbroad or unlawful, disclose only the minimum required, and record the request here. Because prompts and outputs are not retained, there will ordinarily be no Customer Content to disclose.
None
Requests received to date
None
Requests disclosed to a customer
None
Customer Content disclosed
This is also the reporting required for notices about stored content under Terms 15.7. We report the number of notices received and the action taken, not their contents.
Competent authorities: [email protected]
Legal requests and notices: [email protected]
Regulatory readiness
How the Service supports your obligations
A short statement of how the design of the Service maps onto the frameworks named in our Agreement. This is not legal advice; you remain responsible for your own compliance.
EU and UK GDPR
The Data Processing Agreement constitutes the processor contract required by Article 28(3), and the Standard Contractual Clauses apply to the account, billing, support and website data described in DPA Annex E. Processing inside an EU Sovereign Zone involves no transfer to a third country, because requests are confined to the Region Scope.
Read the clauseADGM Data Protection Regulations 2021 and UAE Federal Decree-Law No. 45 of 2021
The Data Processing Agreement is the written processing contract those laws require, and processing inside a UAE Sovereign Zone involves no cross-border transfer for their purposes.
Read the clauseIndia, Digital Personal Data Protection Act 2023
You are the Data Fiduciary and Infinia the Data Processor. We process only on your instructions, apply the security safeguards in the Agreement, and notify you of a breach so that you can notify the Data Protection Board.
Read the clauseDORA, Regulation (EU) 2022/2554
Customers that identify themselves as subject to DORA or an equivalent regime receive an initial incident notification within four hours of our becoming aware, by a named escalation channel, with intermediate and final reports to meet your own regulatory deadlines.
Read the clauseEU Artificial Intelligence Act, Regulation (EU) 2024/1689
You are the deployer, and where applicable the provider, of any AI system you build on the Service; Infinia is not. We state in the Model Catalogue the role we understand ourselves to occupy for each model and make available here the documentation and instructions for use that a deployer requires from us.
Read the clausePublic-sector and regulated customers
Where you are a governmental body, state-owned entity or regulated institution, we cooperate with your regulator, provide the information access your outsourcing rules require, and agree an MSA where our standard terms conflict with your law.
Read the clauseExit and continuity
On termination you may export Usage Data and stored objects for thirty days. Infinia keeps business-continuity and disaster-recovery arrangements appropriate to each Service Mode, as described in the SLA.
Read the clauseCertifications
Independent certification
Independent certifications of our information-security and AI-management systems will be listed here as they are completed. Security questionnaires and audit reports are available to customers under the Data Processing Agreement.
Request documentsFAQ
Frequently asked questions
Do you store or read our prompts and outputs?
No. They are not stored, logged or examined, by people or by automated systems, and are deleted when the request completes. See Terms 6.3.
Is our data used to train models?
No. Neither Infinia nor any model provider may use your content to train or improve a model, and this cannot be turned on. See Terms 6.4.
Where is our data processed?
In the regions your project and API key are scoped to. A request that cannot be served there is refused rather than sent elsewhere. See Terms 6.1 and 6.2.
Is data encrypted?
Yes, in transit using current industry-standard protocols, and at rest for stored objects, with keys managed within the region. See DPA B.12.
Do you sign a Data Processing Agreement?
It is part of our Terms and applies to every customer. It is the processor contract required under GDPR and other national data protection laws. See the Data Processing Agreement.
How are international transfers handled?
Where a transfer of personal data requires it, the Standard Contractual Clauses apply, with the options and annexes completed in DPA Annex E.
Do model providers or other sub-processors see our content?
No sub-processor receives your prompts or outputs. The current list, with each sub-processor’s role and place of processing, is in DPA Annex D, and you get 30 days’ notice of any change.
Are you certified?
Independent certifications of our information-security and AI-management systems will be listed on this page as they are completed. The commitments in Terms 13.1 apply either way: we maintain the certifications listed here, or successor certifications of equivalent scope, and make the reports available to you.
Can we security-test the service?
Yes, with our approval first. Adversarial testing without approval is not permitted under Terms 9.3. Contact us to agree the scope.
Do you scan stored files?
Only the two integrity controls in Integrity controls, applied to Stored Objects and never to Inputs or Outputs. Neither reads what is in the file. See Terms 6.10.
How do we contact you about unlawful content or a legal request?
Through the points of contact in Transparency reporting. Notices about stored content are handled under Terms 15.7.
Documents
Read the documents
Need to review us in detail?
Our team will take your security, legal and procurement reviewers through the platform and the documents.