Skip to content
InfarisTrust Center
Visit infaris.com ↗

Infaris

Trust Center

Security, privacy and compliance at Infaris.

Infaris is IMDigital's identity and monitoring platform. Guard measures uptime, devices, synthetic checks and RUM. This page states, per topic, what is verifiable today and what is still on the roadmap. We are working towards SOC 2 Type II. We are not yet ISO 27001 certified and do not have a SOC 2 report.

IMDigital · KvK 95452354 · Bennekom, the Netherlands

Compliance

Our current status for each standard. Planned certifications are identified separately.

  • GDPR

    Active

    Processing under Regulation (EU) 2016/679 and the Dutch implementation act. The DPA is public.

  • ISO 27001

    On the roadmap

    Processes follow ISO/IEC 27001:2022. There is no certificate and no completed independent audit.

  • SOC 2 Type II

    In preparation

    We are working towards SOC 2 Type II for security, availability and confidentiality. The engagement is in preparation; no SOC 2 report is available yet.

  • PCI DSS

    Via partner

    Card payments run entirely through Stripe (PCI DSS Level 1). Infaris does not store card data.

Documents

Public documents, no login. Internal pentest or ISMS reports are deliberately not listed.

Open-source licensesLicenses and copyright noticesPrivacy policyPolicyData processing agreement (DPA)AgreementTerms of serviceTermsAI transparencyNote

Controls

Web & email securityEncrypted traffic and authenticated email, measured on the live domain.View controls (7)

  • HTTPS / TLS

    Active

    All traffic runs over a valid TLS certificate. Unencrypted connections are rejected.

  • HSTS Preload

    Active

    Strict-Transport-Security with includeSubDomains and preload (2 years) forces HTTPS in every browser.

  • SPF, DKIM & DMARC

    Active

    Email authentication against spoofing and phishing. DMARC is set to reject with strict alignment (adkim=s, aspf=s). MTA-STS is on enforce.

  • Security headers

    Active

    X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy guard against clickjacking and data leakage.

  • Content Security Policy

    Active

    A strict CSP restricts which scripts and resources may load, mitigating cross-site scripting (XSS).

  • DNSSEC

    Active

    Our DNS records are cryptographically signed so they can't be tampered with in transit.

  • Cloudflare WAF & DDoS

    Active

    A Web Application Firewall and DDoS mitigation filter malicious traffic before it reaches our platform.

Identity & accessModern, phishing-resistant authentication for every account.View controls (4)

  • Multi-factor authentication

    Active

    Protect accounts with a second factor on top of the password.

  • Passkeys / WebAuthn

    Active

    Passwordless, phishing-resistant sign-in with biometrics or a hardware key.

  • OAuth 2.0 & OpenID Connect

    Active

    Standards-based single sign-on with a public OpenID configuration and JWKS endpoint.

  • Bot protection

    Active

    Cloudflare Turnstile blocks automated abuse without intrusive captchas.

Privacy & GDPRData protection under the European GDPR, by design.View controls (4)

  • GDPR compliant

    Active

    Processing under the General Data Protection Regulation (EU) 2016/679 and the Dutch implementation act.

  • EU hosting

    Active

    Data is stored and processed within the European Union (Netherlands).

  • Data Processing Agreement

    Active

    A Data Processing Agreement (DPA) is available for business customers.

  • Right to access & erasure

    Active

    Export or delete your data on request, in line with your rights under the GDPR.

NCSC basic principles for digital resilience

The Dutch NCSC and Digital Trust Center publish five basic principles for digital resilience. Guard by Infaris is a monitoring platform: it directly supports three principles, partially supports one, and one sits outside the product's scope.

View controls (5)

  • Map your risks

    Supported by Guard

    Guard gives visibility into domains, devices, certificates and vulnerabilities (including a WordPress scan), so you know what to protect.

  • Promote safe behaviour

    Out of scope

    This principle is about staff awareness and a safe reporting culture. Guard monitors systems, not behaviour: this sits outside the platform's scope.

  • Protect systems, applications and devices

    Supported by Guard

    Uptime, synthetic and RUM monitoring, security header checks and device monitoring flag misconfiguration and outages in time.

  • Manage access to data and services

    Out of scope

    Guard applies this principle to its own dashboard roles, but does not manage access to your own systems and data.

  • Prepare for incidents

    Partially supported

    Incident detection, alerting and status pages support a fast response. Guard does not create or test backups and does not run exercises.

Source: ncsc.nl/basisprincipes

NIS2: what's required, what Guard does

The NIS2 directive requires designated sectors to apply risk-management measures and report incidents. Guard by Infaris is not a compliance or legal product: it supports part of the technical measures, while the reporting duty and governance stay with your organisation.

View controls (5)

  • Risk analysis and incident detection

    Supported by Guard

    Continuous uptime, device and synthetic monitoring flags anomalies and incidents, with alerts straight to your team.

  • Vulnerability handling and cryptography

    Supported by Guard

    SSL/TLS, security-header and CVE checks (including a WordPress scan) support the technical measures from Article 21.

  • Business continuity and supply chain

    Out of scope

    Guard does not create or test backups, disaster-recovery plans or supplier risk assessments.

  • Access control and cyber hygiene

    Out of scope

    MFA and role-based access apply to Guard's own dashboard, not to your organisation's systems or staff.

  • Reporting to the supervisory authority

    Out of scope

    Guard alerts your team, but does not file the formal 24-hour or 72-hour notification to the CSIRT or supervisory authority. That legal duty stays with your organisation.

Source: Directive (EU) 2022/2555 (NIS2)

Sub-processors

Vendors that process personal data for Infaris services. The DPA confirms the customer-specific list before signing.

  • OVH

    Netherlands / EU

    Production hosting of the Infaris platform (self-hosted Docker).

  • Cloudflare

    Edge, with EU processing where applicable

    DNS, WAF, DDoS mitigation, Turnstile and encrypted offsite backups (R2).

  • Stripe

    EU entity for European customers

    Subscription and card payments. No card data in our systems.

FAQs

Where is the data stored?

Inside the European Union, in the Netherlands. Traffic runs over TLS. Unencrypted connections are refused.

Are you ISO 27001 or SOC 2 certified?

Not yet. We shape processes around ISO 27001 and are working towards SOC 2 Type II. The SOC 2 engagement is in preparation; no report is available yet. We also do not yet hold an ISO 27001 certificate. Our current status is listed per standard above.

Is there a data processing agreement?

Yes. The model DPA is at infaris.com/dpa and can be used without asking us first. The definitive sub-processor list is confirmed before signing.

How do I report a vulnerability?

Email info@infaris.com. Responsible disclosure is welcome. There is no bug-bounty programme.

Have a security question or found a vulnerability?

We value responsible disclosure. Reach out to our security team and we'll respond quickly.

Email info@infaris.com