Compliance at Infer
How we approach compliance
Infer's compliance program is built in the same order as the service itself: controls first, then attestation. The properties most frameworks exist to verify (that customer data is not retained, not exposed, and not misused) are structural facts of how Infer serves inference, enforced by the architecture rather than layered on afterward. The program below is the work of having those properties independently examined, papered, and kept current, and this page states plainly where each engagement stands. Status lines here are updated as milestones complete, never in advance of them.
Standards & frameworks
Each engagement has its own page describing what the standard covers, how Infer's architecture maps to it, and its current status.
| Standard | Scope | Status |
|---|---|---|
| HIPAA | US health information; business-associate role | Program in development; BAA in legal preparation |
| SOC 2 | Security & Confidentiality trust services criteria | Type I engagement in preparation; evidence collection underway |
| GDPR / UK GDPR | EU/UK data protection; processor role | Processor readiness underway; DPA with SCCs in legal preparation |
| CCPA / CPRA | California privacy; service-provider role | Position established and operative |
| NIST AI RMF | AI risk management, scoped to serving infrastructure | Alignment statement published |
| CSA STAR | Cloud security self-assessment (CAIQ v4), public registry | Level 1 self-assessment in progress |
Under evaluation
The following certifications are under active evaluation, sequenced behind the engagements above so that each builds on the evidence base of the last rather than starting fresh:
- ISO/IEC 27001 (with the ISO/IEC 27701 privacy extension): international information-security management certification.
- ISO/IEC 42001: AI management system certification.
- HITRUST: healthcare-sector assurance, building on the HIPAA program.
Two frameworks have documented determinations rather than active programs: PCI DSS is not applicable: Infer does not process, store, or transmit cardholder data, and FedRAMP is a determination we revisit annually as the customer base develops. Both determinations are reviewed on the program's regular cadence.
Controls inherited from our infrastructure
Infer runs on major cloud infrastructure whose operators independently maintain some of the industry's most extensively audited environments. Physical and environmental safeguards (data-center access control, media handling, hardware lifecycle) are provided by facilities certified and attested against standards including ISO/IEC 27001, ISO/IEC 27017 and 27018, SOC 1/2/3, PCI DSS, FedRAMP, HITRUST, and CSA STAR, with FIPS 140-validated cryptographic modules underlying encryption at the platform layer.
Inheritance is verified, not assumed: confirming each provider's certifications and their applicability to our deployment is part of the subprocessor compliance evaluation described on the security page, and regulated workloads are placed only on infrastructure that has completed that evaluation.
Questions & documentation
Detailed documentation for any engagement above is available to qualifying customers as milestones complete. For diligence questionnaires, documentation requests, or questions about any status on this page:
contact@infer.industries