Security

Our approach

Security and governance are design inputs in every engagement we run, not a review at the end. The same expectation applies to how we run our own business.

This page describes our practices at a high level. Clients can request detailed control documentation, architecture diagrams and evidence under NDA as part of a due-diligence or vendor-assessment process.

Protecting our systems

• Multi-factor authentication on all company accounts, with single sign-on and conditional access.
• Least-privilege access, reviewed regularly, with elevated access granted just-in-time.
• Company devices are encrypted, centrally managed and patched, with endpoint detection in place.
• Encryption in transit and at rest for data we hold, with logging and alerting on access.
• Secrets held in managed vaults, never in source control, with rotation on personnel change.

Working inside client environments

We prefer to work in client-controlled environments with client-issued identities, so access is visible and revocable by you at any time.

• Access is scoped to the engagement and removed at its conclusion.
• Production data is not copied into our environment; where test data is needed, we use synthetic or de-identified data.
• Client data is never used to train models or for any purpose outside the engagement without written authorisation.
• Personnel are background-checked where a client requires it, and bound by confidentiality obligations.

Security of AI systems

AI systems carry risks that traditional application testing does not cover. We threat-model for prompt injection, data leakage through context, excessive agency in tool use, and supply-chain risk in models and dependencies.

Systems we build ship with evaluation sets, guardrails, audit trails and a model registry, so behaviour can be reviewed and evidenced after deployment rather than assumed.

Frameworks we align to

Depending on the client and the workload, we design and evidence controls against frameworks including the ISO/IEC 27001 and 42001 families, the ASD Essential Eight, and the Australian Privacy Principles.

Alignment means we design to and evidence against these frameworks; any certification held by Infin IT is stated explicitly and can be verified on request.

Incident response

We maintain an incident response process covering detection, containment, notification and review. Where an incident affects a client, we notify the client without undue delay and support their own response and regulatory obligations, including notifiable data breach assessment where applicable.

Reporting a vulnerability

If you believe you have found a security issue in our website or a system we operate, please tell us at hello@infinit.com.au with enough detail to reproduce it.

We will acknowledge your report within two business days, keep you updated while we investigate, and will not pursue action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to remediate before disclosing publicly.