Infra0 takes security seriously. All data is encrypted in transit and at rest.

• Sessions are managed via secure, HTTP-only cookies
• Sessions last 7 days and are refreshed roughly once per day while you stay active
• An idle session expires 7 days after it was last refreshed
• In production, every request is validated against the database (no client-side cookie cache)
• Logging out terminates your session immediately
• Multiple sessions on different devices are supported

• 2FA / TOTP is not available yet. It is planned for a future release.

• OAuth tokens are stored securely and are never exposed in URLs
• Login SSO (Google, GitHub, and backend Microsoft) is separate from repository integrations
• Repository integrations (Azure DevOps and GitHub) use their own OAuth authorization-code flow to connect version-control repositories
• OAuth provider tokens can be revoked from within your provider account
• Disconnecting an OAuth provider will not delete your Infra0 account

• All cloud provider credentials are encrypted before storage
• Credentials are never exposed in plain text in the UI
• Sensitive fields are masked and require explicit action to view
• Credentials can only be accessed by users with the appropriate permission

• Every API call validates the user's permissions server-side
• Frontend route guards prevent unauthorized page access
• Permission denials are logged in the Activity Stream
• Admins can view who has access to what at any time