CSA STAR
Summary
The Cloud Security Alliance maintains the STAR registry, a public directory in which cloud service providers publish their security posture against the CSA Cloud Controls Matrix. Level 1 is a provider self-assessment: the provider answers the Consensus Assessments Initiative Questionnaire (CAIQ) control by control, and the completed questionnaire is published on the registry for anyone (customers, their auditors, their procurement teams) to read.
Infer's CAIQ v4 self-assessment is in progress, with submission to the public STAR registry to follow. This is part of Infer's compliance program, and we are doing it early and deliberately: it puts our answers on the public record, in a standard format, before the first customer asks. When the entry is live, this page will link directly to it.
Why this assessment suits Infer
A large share of CAIQ controls ask a provider what it does with stored customer data: how it is classified, encrypted, backed up, located, retained, deleted, and proven deleted. Those are the questions that normally generate long, hedged answers referencing internal procedures. Infer answers them from architecture instead: prompts and completions exist only in volatile memory for the life of a request and its transient session cache. They are never written to durable storage, never logged, never used for training, and never shared. That makes the assessment unusually crisp: the answer to a whole family of controls is the same structural fact, and it is verifiable in the system's design rather than asserted in a policy.
Concretely:
| CAIQ domain | What Infer's answer rests on |
|---|---|
| Data security & lifecycle | Controls on classification, retention schedules, secure disposal, and deletion proof collapse to one fact: customer content is never written to durable storage, so there is no store to classify, schedule, sanitize, or prove erased. Volatile state is evicted automatically and does not survive a replica restart. |
| Logging & monitoring | Logs are metadata-only by construction (timestamps, token counts, status codes, latency, hashed identifiers), retained 30 days. The content-exclusion property is a property of the log schema, not a redaction step that could be misconfigured. |
| Identity & access management | The gateway accepts a single authorized upstream API caller, our routing partner, and end users never connect directly. No internal tool, console, or export path surfaces customer content to personnel, so the access-review question is answered by the absence of the path rather than by the size of the access list. |
| Cryptography & key management | TLS terminates at the external edge; traffic between the gateway and compute runs over an encrypted overlay network. There is no content at rest, so the encryption-at-rest and key-rotation-for-stored-data controls have no data to cover. |
| Application & interface security | Debugging and load testing use synthetic traffic only; there is no production-content path into a developer's hands. Overload is shed with 429 at admission rather than queued, so no request backlog accumulates anywhere. |
The corollary matters too, and we state it plainly: the domains that architecture does not answer (governance, human resources security, business continuity, supply chain) are answered from Infer's written policies and procedures, and those answers are being completed as part of the same effort. A self-assessment is only worth publishing if every domain is answered honestly, including the ones where the honest answer is a young program run by a small team.
What the assessment covers
CAIQ v4 follows the Cloud Controls Matrix domain structure. The assessment covers, among others:
- Audit & assurance; governance, risk and compliance
- Data security & privacy lifecycle management
- Identity & access management
- Cryptography, encryption & key management
- Logging & monitoring
- Application & interface security
- Infrastructure & virtualization security
- Threat & vulnerability management
- Security incident management, e-discovery & forensics
- Business continuity management & operational resilience
- Supply chain management, transparency & accountability
- Human resources security; universal endpoint management
- Interoperability & portability; datacenter security
Each control is answered for Infer specifically, with the shared-responsibility boundary stated where a control is inherited from our infrastructure providers rather than implemented by Infer directly.
Status
The CAIQ v4 self-assessment is in progress. Work is proceeding domain by domain: architecture-derived answers first, then the governance and operational domains that draw on Infer's written policies. Submission to the public STAR registry follows completion of the questionnaire, and the registry link will be published on this page on submission.
Infer is pre-launch and serves no production traffic yet; figures and controls described across this site are design commitments until measured in operation. STAR Level 1 is a self-assessment, not a third-party audit or certification; it is a public, structured, attributable statement of posture, and we treat it as exactly that. Independent attestation work sits further along the compliance program.
To ask about a specific control, or to request the questionnaire in its current state for a diligence review:
contact@infer.industries