Product

Security

Your data, credentials, and people are protected by design—isolated per organization, protected by hashed passwords, brute-force lockout and rotating session tokens, governed by role-based access.

Start free Talk to our team

Security is part of the architecture, not a setting

InfiniStack doesn’t bolt protection onto a shared system after the fact. Every organization is provisioned its own pipeline project, passwords are hashed before they are stored, and sign-in is protected by lockout and short-lived rotating tokens.

The result: your team gets a platform that is safe to hand to analysts, executives, and AI alike—without trading away control over who sees what.

Isolation
Per organization
Passwords
Hashed (bcrypt)
Sign-in
Lockout protected
Access
Role-based (RBAC)

A hard boundary around every organization

When your organization is created, InfiniStack provisions a dedicated pipeline project and schedule just for you. Your pipeline configuration is never shared with another tenant.

  • Dedicated pipeline project and schedule — your connector configuration and run history live in your own workspace.
  • Every request is scoped to your organization — dashboards, reports, metrics, and Chat only ever see your tenant’s records.
  • Data lands in the destination you connect — InfiniStack orchestrates movement and transformation into your own warehouse.

Sign-in you can trust

Layered authentication controls protect every account, from the first login to the last session.

Strong password handling

Passwords are hashed with bcrypt and never stored in plain text. A policy of 8–128 characters with upper-case, lower-case, and a digit is enforced on sign-up, reset, and every change.

Brute-force lockout

Repeated failed sign-in attempts for an email address temporarily lock further attempts, stopping password-guessing attacks before they get anywhere.

Session control

See every device signed in to your account and revoke any session—or all other sessions at once—with a single click.

Rotating tokens

Short-lived signed access tokens are refreshed through an HttpOnly cookie. Tokens rotate on every refresh, and reuse of an old token revokes the whole session.

Secrets stay secret

Connecting a source means trusting us with its keys. We treat them accordingly.

  • Passwords are hashed — with bcrypt, never stored in plain text.
  • Scoped to your organization — connector credentials belong to your organization and are only used to run your own pipelines.
  • Approved connectors only — each organization can be limited to an allow-list of connectors, so data only flows where you intend.

The right access for every person

Grant exactly what each person needs—and keep AI inside the same guardrails.

  • Role-based access control — admin, integrator, and member roles decide who can manage users and teams, manage connectors and pipelines, or work with the data.
  • Teams and invitations — organize people into teams and bring them in through invitations you control.
  • Governed AI Chat — organization admins set the AI agent’s instructions and out-of-scope response, and per-team policies add a fixed prompt and restricted terms. An optional PII Guard can be enabled per organization.

Common questions

Can another customer ever see my data?

No. Each organization has its own pipeline project and schedule, and every request is scoped to the organization of the signed-in user. See Architecture for how isolation works end to end.

Where does my data live?

InfiniStack orchestrates movement and transformation into the destination you connect, and dashboards, reports, and Chat query that layer. The platform also keeps its own metadata, such as pipeline configuration, run history, and chat context.

How do I report a security issue?

Please reach out through our contact page. We take every report seriously and will respond as quickly as possible.

Analytics your security team can sign off on

Get isolated pipelines, protected sign-in, and governed AI from day one.

Start free Book a demo