How Infracast handles your data and credentials

Data collected

Infracast collects infrastructure metadata through read-only connectors: asset inventory, configuration, relationships, and findings derived from them. It builds attack paths and evidence from that metadata.

Connectors read through provider APIs. They are not installed as agents on your workloads.

Credential handling

• Credentials are encrypted at rest with AES-256-GCM.
• Optional AWS KMS envelope encryption for stored credentials.
• Credentials are scoped per tenant.
• With the on-premises relay, credentials are kept in memory and never written to disk. See deployment.

Access: read-only roles

Cloud connectors use read-only roles that you create and can revoke at any time. Infracast does not need permission to change your infrastructure to discover it.

The Terraform export produces code for you to review and apply yourself. See export boundary.

Tenancy

The hierarchy is Account, then Tenant, then Workspace. Credentials are held per tenant, and data is organized under the tenant that owns it.

Retention (SaaS)

Hosting

The SaaS service runs on AWS in us-east-1. For environments that cannot send data out, a disconnected install is available; see deployment.

Certification status

The current status is stated in the footer of every page. We do not claim an authorization we do not hold. Ask for the control mapping if your review needs it.