Security & trust
Security at Infralign
Infralign reads your Azure billing data and resource metadata through two built-in read-only roles. You grant them, you choose the subscriptions, and you can remove access at any time.
Infralign connects to Azure through one Microsoft-verified application in your own tenant. Four controls follow from that.
| Control | What it means |
|---|---|
| Read-only by design | Two built-in Azure roles, no write permission of any kind |
| Nothing in your estate | No agent, no VM, no inbound access |
| EU-hosted | Microsoft Azure, EU regions, with EU disaster recovery |
| Revocable in your tenant | Remove the roles or disable the enterprise application yourself; no call to Infralign needed |
Access model
Section titled “Access model”One Microsoft-verified app in your tenant handles sign-in and data access. You assign it two built-in read-only roles on the subscriptions you choose. Each night, Infralign pulls billing data and resource metadata from five read-only sources in your tenant, all of them inside those two roles; data sources names each one and the api-version it is called at. What it ingests is cloud operations telemetry, not customer content. The data lands in a stack that holds your data only, and figure 1 draws it end to end.
The two roles are the built-in Reader and Cost Management Reader roles, exactly as Microsoft defines them. Permissions lists every action they cover.
One optional lane exists. For estates whose daily cost export outgrows the nightly window, the FOCUS 1.2 export lane adds a third built-in role, Storage Blob Data Reader, on a storage account you create and control. It is off unless you turn it on. See FOCUS exports and storage setup.
What Infralign sees, and what it cannot
Section titled “What Infralign sees, and what it cannot”| Category | Access | Detail |
|---|---|---|
| Billing and cost data | Read | Cost and usage records from Azure Cost Management |
| Resource metadata | Read | Names, types, tags, regions, and SKUs, via Azure Resource Graph |
| Utilisation metrics | Read | Aggregate performance metrics, via Azure Monitor |
| Advisor recommendations | Read | Microsoft’s own cost, reliability, and efficiency recommendations, via Azure Advisor |
| Control-plane activity | Read | Subscription-level change events, via the Azure Activity Log. Control-plane records only, never the contents of a resource |
| Business data, documents, databases | Never | No granted permission reaches them. The one exception is the storage container you create for the optional FOCUS export lane, which is read only if you enable that lane |
| Application content and workloads | Never | Nothing runs inside your estate, and there is no inbound access |
| Credentials and secrets | Never | On the default single-app connection Infralign stores no customer secrets: access runs through Microsoft Entra ID. A legacy connection mode, not offered to new customers, stores an encrypted client secret |
| Write, deploy, or configuration access | Never | Both roles are read-only by Microsoft’s definition |
| AI or LLM training | Never | Your data trains no model. The chatbot’s inference runs on Azure OpenAI in an EU region |
| Personal data (PII) | Not collected | Not collected by design. Resource names, tags, and sign-in identities can still carry it, so all customer data is treated as confidential under the DPA |
The consent you grant
Section titled “The consent you grant”Onboarding is one admin consent plus two role assignments. The Microsoft consent screen asks for two delegated permissions. It names Infralign Smart Solutions with Microsoft’s blue verified-publisher checkmark. The checkmark means Microsoft has verified Infralign’s company identity.
| What the consent screen asks | Why |
|---|---|
View your basic profile | Signs you in and shows who you are inside the app |
Maintain access to data you have given it access to | Keeps your session working without repeat consent |
User consent and data access are separate. The consent screen covers sign-in only. Data access comes from the two read-only roles your admin assigns in your own tenant.
Profile only, nothing else in your tenant. The two permissions are User.Read and offline_access, both delegated. Your admin will see them listed under Microsoft Graph on the consent screen. They reach only the signed-in user’s basic profile. No application permissions. If your tenant runs the admin consent workflow, a Global Administrator can pre-consent before rollout.
What your admin does
Section titled “What your admin does”- Who accepts the consent: any one of Global Administrator, Privileged Role Administrator, or Cloud Application Administrator. Not a Global Administrator only.
- Who assigns the roles: Owner or User Access Administrator on the scope you choose.
- In many organisations these are two different people. Find both before you book the time. Nobody needs permission to register applications.
- How long: About 15 minutes at the keyboard, and about 30 minutes elapsed, including the waits. The consent wait and the propagation wait overlap, so neither blocks the other.
-
Grant admin consent (from the onboarding link Infralign sends you)
- Creates one enterprise application in your tenant. Verify the Application ID:
f7113fd5-938a-4551-9406-e8e964e0308e. Checking the ID confirms you are consenting to the genuine service principal. - After accepting, the browser lands on an “access denied” page at
app.infralign.aicarryingadmin_consent=True. Expected: a consent receipt is not a sign-in. Dashboard sign-in owns this step, including the four checks to make before accepting.
Prefer the direct admin-consent URL?
Find it in the Microsoft Entra admin center (entra.microsoft.com) under Overview → Tenant ID, or in portal.azure.com under Microsoft Entra ID → Overview. A GUID or a verified domain both work.
That does not look like a tenant ID or a verified domain. The link below still works if you meant it.
https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=f7113fd5-938a-4551-9406-e8e964e0308e&redirect_uri=https%3A%2F%2Fapp.infralign.ai%2Foauth2%2FcallbackBuilt in your browser. Nothing is sent anywhere.
- Creates one enterprise application in your tenant. Verify the Application ID:
-
Assign the two roles: Reader and Cost Management Reader
- On the subscriptions you choose, or once at a management group that contains them. A management-group assignment also covers subscriptions added to that group later.
- Portal path: Subscription → Access control (IAM) → Add role assignment.
-
Done: the first run happens the following night.
- These are the canonical setup numbers, and that page owns them.
Data residency
Section titled “Data residency”- Microsoft Azure, EU regions. An Irish company processes and stores your data in Microsoft’s EU regions, under EU law.
- Isolated per-customer stacks. Your own database, storage, and apps. Two things are shared: a sign-in proxy that handles sign-in only, and the tooling Infralign deploys and operates the stacks with. Neither holds customer data. Isolation and data handling has the mechanics.
- EU disaster recovery. Backup copies live in a second EU region. Processing and storage stay in the EU/EEA; the Cloudflare edge qualification is in the DPA key terms.
Who secures what
Section titled “Who secures what”Security responsibilities are split between Microsoft and Infralign.
Microsoft operates. Independently audited: ISO 27001, SOC 2, and more. Reports sit on the Microsoft Service Trust Portal.
- Physical data centre security
- Host infrastructure, network, and hypervisor
- Platform services: compute, storage, identity
Infralign is responsible for the application layer:
- Application code, APIs, and data pipelines
- Access control, tenant isolation, and encryption settings
- Operational security, monitoring, and incident response
Practices
Section titled “Practices”- Identity. Microsoft Entra ID sign-in. MFA is enforced on every Infralign account. Access is least-privilege and reviewed.
- Encryption. TLS 1.2+ for all data in transit. At rest, Azure storage-service encryption on every store, with Azure-managed keys.
- Tenant isolation. One Azure tenant under Infralign’s control. Each customer’s data sits in its own stack.
- Support access to your data. Direct warehouse access is limited to named engineers, granted for a specific support or delivery task, protected by MFA, and logged.
- Secure development. GitHub source control with branch protection, mandatory review, and dependency scanning.
- Data pipelines. One nightly read-only run per customer stack. The chatbot reads your data only. Inference runs on Azure OpenAI in an EU region, and your data trains no model.
- Resilience. Backups in a second EU region, restore-tested quarterly. RTO 24 hours; RPO 24 hours, the nightly run cadence. Availability target 99.5%. Deletion on offboarding or on request.
Certifications and audits
Section titled “Certifications and audits”| Milestone | Status | Expected |
|---|---|---|
| Cyber Essentials (NCSC-UK / IASME) | Application submitted | September 2026 |
| CSA STAR Level 1 registry listing (CAIQ v4.1) | In preparation | October 2026 |
| Independent cyber review, NCSC-structured, under the Enterprise Ireland scheme | Commissioned | Q4 2026 |
| External penetration test by a CREST-accredited firm, with a shareable attestation letter | Being scheduled | Q4 2026 |
| Cyber liability and technology E&O cover | In procurement | October 2026 |
| ISO 27001:2022 certification (INAB-accredited certification body) | Programme starting | Target H1 2027 |
Company and ecosystem
Section titled “Company and ecosystem”Microsoft-verified publisher. Microsoft has verified Infralign’s publisher identity, and the offer passed Microsoft’s commercial marketplace certification review. Infralign is a Microsoft ISV partner through the ISV Success programme.
NovaUCD AI accelerator. Infralign is a member of the AI accelerator at NovaUCD, University College Dublin’s innovation hub.
Irish company, EU jurisdiction. Infralign Smart Solutions Limited is an Irish private company limited by shares, registered with the Companies Registration Office (reg. 815072). Your contract, your data, and your legal recourse sit under EU law.
GDPR and data protection
Section titled “GDPR and data protection”- Processor under Article 28. We process on your documented instructions. Our DPA uses the European Commission’s Standard Contractual Clauses for controller-processor terms (2021/915). Key DPA terms are published at DPA key terms; the full document is shared during your review.
- Two subprocessors.
- Microsoft Azure (EU regions): hosts the platform, including the chatbot. Inference runs on Azure OpenAI in an EU region. Your data trains no model. Prompts and outputs stay in the EU, retained only under Microsoft’s documented abuse-monitoring policy.
- Cloudflare, Inc.: content delivery and edge security in front of the platform.
- We give at least 30 days’ written notice before any addition.
Questions compliance teams ask
Section titled “Questions compliance teams ask”Are you ISO 27001 certified?
Section titled “Are you ISO 27001 certified?”Not yet. Target: H1 2027, and Infralign will commit to that in contract.
Infralign is pursuing ISO 27001:2022 with an INAB-accredited certification body. A gap assessment and an operational ISMS come first, on the roadmap above. Until then: access is read-only and scoped to billing metadata, everything is EU-hosted, and the dates are published.
Where is our data stored and processed?
Section titled “Where is our data stored and processed?”Microsoft Azure, EU regions. Backups in a second EU region.
Processing and storage are in the EU/EEA, Azure OpenAI inference included. Cloudflare provides edge delivery in front of the platform, which is the one qualification: the DPA key terms state it.
Can Infralign modify anything in our Azure estate?
Section titled “Can Infralign modify anything in our Azure estate?”No. Every permission Infralign holds is read-only.
Infralign has no write, deploy, or configuration permission. Nothing runs inside your estate, and there is no inbound access. You review Infralign’s recommendations and apply them yourself.
How do we revoke Infralign’s access?
Section titled “How do we revoke Infralign’s access?”In your own tenant, at any time. No call to Infralign.
Remove every role assignment held by the Infralign application at your chosen scope, then delete the enterprise application. The order matters, the role count is two on the default connection and three with the FOCUS export lane, and access ends once Azure’s authorization cache refreshes. Ending the connection is the single source for all of it, including the pause option and the timing bound.
Deleting the data already collected is a separate request. See the DPA key terms.
What personal data do you process?
Section titled “What personal data do you process?”None by design. Incidental personal data can still occur, so Infralign acts as a GDPR processor.
Two incidental paths exist. Resource names, tags, and account identifiers can contain personal data, such as a name in an owner tag. And sign-in processes your users’ work identity. Infralign therefore treats all customer data as confidential and offers a DPA. Infralign makes no “zero personal data” claim.
Do other customers share our database?
Section titled “Do other customers share our database?”No. Your stack is yours alone.
Each customer gets an isolated stack: their own database, storage, and apps. Two shared components exist and neither holds customer data. Isolation and data handling names them and gives the storage- and query-layer mechanics.
Who are your subprocessors?
Section titled “Who are your subprocessors?”Two: Microsoft Azure (EU regions) and Cloudflare, Inc.
Microsoft Azure hosts the platform, including Azure OpenAI for the chatbot. Cloudflare sits in front of it as the content-delivery and edge-security layer, handling transit and TLS termination on a global edge network.
How would you notify us of a security incident?
Section titled “How would you notify us of a security incident?”Within 48 hours of awareness, contractual in our DPA.
- Default: without undue delay after we become aware of a breach that affects your data, and in any case within 48 hours, so your own 72-hour regulatory clock keeps its margin.
- Shorter clocks: where your regulatory timelines are shorter, an initial notice within 24 hours of awareness can be agreed in the DPA.
- What you get: a named contact, what we know, and what we are doing.
How long do you keep our data after we leave?
Section titled “How long do you keep our data after we leave?”Deleted within 30 days of offboarding or request, backups included. Confirmed in writing.
While you are a customer, cost history is retained for the life of your subscription, with up to 13 months backfilled on first connection. The DPA key terms carry the retention and deletion terms.
Do you carry cyber liability insurance?
Section titled “Do you carry cyber liability insurance?”Not yet. Cover is being placed now, expected before October 2026.
Cyber liability and technology E&O. Infralign will share the certificate of insurance and cover limits during your review.
Can we audit you?
Section titled “Can we audit you?”Yes. Article 28(3)(h) audit and inspection rights are in our DPA.
In practice Infralign supports audits with a completed CAIQ (from October 2026, when the CSA STAR Level 1 listing goes in), policy summaries, the pen test attestation letter (from Q4 2026), and full questionnaire responses. Ahead of those dates Infralign answers your own questionnaire in full, in your format. On-site or remote audits run by agreement.
Do you screen and train your staff?
Section titled “Do you screen and train your staff?”Yes: confidentiality, training, and least-privilege access.
- People: everyone with access to customer data signs a confidentiality agreement and completes security training. Background checks apply to all future hires, as permitted under Irish law.
- Access: access to production and customer data is limited to named engineers, least-privilege and protected by MFA.
Contact
Section titled “Contact”Infralign answers security questionnaires in full, in your format or ours, and shares the DPA, architecture detail and policy summaries on request. Email [email protected].
Found a security issue? Report it to [email protected]. Infralign acknowledges within two business days and will not pursue good-faith research.
Last reviewed: 1 September 2026 · v4.0 · DPA key terms · security.txt