Terms of Service & Security Policy

infraYX MSP Platform
Effective date: June 19, 2026 · Version 1.0

1. Overview

infraYX is a cloud-based multi-tenant managed-service-provider (MSP) automation platform hosted in the European Union. It provides centralized management of identity, network, compute, and cloud resources across multiple client environments from a single portal.

Tenant data is isolated at both the data layer and the network layer — each tenant operates within a logically and technically separate environment. No cross-tenant data access is architecturally possible.

2. Trial Period & Account Lifecycle

Every new tenant receives a 15-day free trial with full platform access. After the trial, the account progresses through a defined lifecycle:

2.1 Super-admin controls

infraYX platform administrators may at any point:

• Extend trial — add any number of days to the current trial expiry
• Activate (production) — convert the account to indefinite active status
• Suspend manually — immediately move to suspended state
• Purge — manually trigger irreversible data deletion (requires typed confirmation of tenant ID)

2.2 Reactivation during suspended period

Tenants may contact hello@infrayx.io at any time during the suspended period (days 31–45) to reactivate. Reactivation converts the account to indefinite active status. No data is lost as long as the account is reactivated before day 46.

3. Data Retention & Deletion Policy

infraYX collects and stores the following categories of tenant data:

3.1 Purge (day 46+)

On permanent deletion, all tenant data is irreversibly removed: client configurations, stored credentials, portal user accounts, audit log entries, scheduled actions, and network tunnel configurations. The tenant record is retained as a deletion tombstone for internal audit purposes only.

A deletion-confirmation email referencing GDPR Article 17 (Right to Erasure) is sent to the registered admin email address upon completion.

4. Encryption

4.1 In transit

• All browser-to-platform communication uses TLS 1.2+ (TLS 1.0/1.1 are disabled)
• All internal service-to-service communication uses HTTPS with signed requests and does not traverse the public internet
• Client-to-platform VPN uses modern ECDH key exchange with authenticated encryption

4.2 At rest

• Database storage: encrypted at rest with platform-managed keys
• Credential storage: AES-256 encryption with KMS-managed keys; point-in-time recovery enabled
• Object storage: AES-256 encryption; public access blocked at account level
• Audit logs: encrypted at rest
• User passwords: hashed with bcrypt (SRP protocol); plaintext passwords are never stored

5. Security Posture

5.1 Identity & Access Management

• MFA (TOTP) enforced for all portal users
• Principle of least privilege: role-based access with five permission tiers
• Self-registration is disabled; users are provisioned only by authorized MSP administrators
• Session tokens use silent rotation; no long-lived credentials stored in the browser
• All backend service accounts follow least-privilege; no wildcard permission grants on production resources
• Full audit trail of all access and operations

5.2 Network security

• All backend services run in a private network with no direct internet ingress
• Client VPN connections use per-client authorized source IP restrictions, automatically maintained
• Geographic access restriction is in place — access is permitted only from an approved list of countries
• All API endpoints require authentication; no unauthenticated access except the public registration endpoint
• Internal service-to-service traffic does not traverse the public internet

5.3 Vulnerability management

• All serverless runtime environments receive security patches automatically from the cloud provider
• Third-party dependencies are pinned; updated on any upstream CVE notification
• No direct remote access to the production serverless environment; all access goes through authenticated API endpoints
• Infrastructure management access is restricted to authorized IP addresses over encrypted channels

5.4 AWS Well-Architected alignment

5.5 Incident response

In the event of a security incident affecting tenant data:

1. Affected tenant(s) will be notified at the registered admin email within 72 hours of the operator becoming aware (GDPR Article 33/34)
2. Notification will include: nature of incident, data categories affected, likely consequences, and mitigating measures taken
3. A post-incident report will be provided within 14 days

6. Privacy & GDPR

infraYX acts as a data processor on behalf of tenant organizations (the data controllers). infraYX is operated by a company established in the Republic of Serbia and processes personal data in accordance with GDPR (EU 2016/679) and Serbian law on personal data protection (ZZPL).

6.1 Data we process

• Portal users: email, name, role, last-login timestamp (Cognito)
• End-user identities (your clients): usernames, email addresses, group memberships — only when the MSP admin connects a directory or identity system via the platform. These are processed transiently (in Lambda memory) and the operator does not retain them independently of the MSP's own systems
• Audit log: action, performed_by email, timestamp, client context — retained for 365 days

6.2 Sub-processors

6.3 Your rights

As a data subject you have the right to access, rectify, erase, restrict, and port your personal data. Submit requests to hello@infrayx.io. We will respond within 30 days.

7. Acceptable Use Policy

You may use infraYX solely for lawful managed-service operations. The following are prohibited:

• Attempting to access or modify another tenant's data
• Storing credentials, keys, or tokens unrelated to systems you are authorized to manage
• Using the platform to conduct offensive security operations, port scanning, or network attacks against third parties
• Circumventing authentication, authorization, or geo-restriction controls
• Attempting to exhaust platform resources (DDoS, credential stuffing, API flooding)
• Processing special-category personal data (health, biometric, financial) via the platform without a separate Data Processing Agreement

Violations may result in immediate account suspension and/or legal action.

8. Limitation of Liability & Disclaimer

The infraYX platform is provided "as is" during the trial period and until a separate SLA agreement is signed. The operator makes no warranty of merchantability or fitness for a particular purpose.

To the maximum extent permitted by applicable law, the operator's total cumulative liability for any claim arising from use of the platform shall not exceed the amount paid by the tenant in the twelve months preceding the claim. For trial accounts (zero paid), total liability is capped at EUR 100.

The operator is not liable for: data loss caused by tenant misconfiguration; credential exposure caused by weak passwords or phishing at the tenant's side; service disruptions caused by AWS infrastructure outages; or actions taken by systems the tenant has connected to the platform.

9. Availability & SLA

During the trial period, no formal SLA is offered. The platform targets 99.5% monthly uptime for paid production accounts (defined as API Gateway & CloudFront availability, excluding planned maintenance).

Key resilience features: serverless managed runtime (no maintenance windows), automated infrastructure recovery (RTO ~5 minutes), database point-in-time recovery (RPO ~1 second), global CDN. Planned maintenance will be announced to registered admin emails at least 24 hours in advance.

10. Marketing & Transactional Emails

By registering, you consent to receive the following email categories from noreply@infrayx.io (sender) and hello@infrayx.io (reply-to):

• Transactional: trial status changes, deletion warnings, GDPR confirmation — cannot be unsubscribed from while the account is active
• Value emails during suspension: three emails sent during the 15-day suspended period highlighting platform capabilities and ROI. Each email includes an unsubscribe link. Unsubscribing stops suspension-period value emails but does not prevent the mandatory deletion-warning email on day 44

We do not sell, share, or rent email addresses to third parties.

11. Governing Law & Dispute Resolution

These terms are governed by the laws of the Republic of Serbia. Disputes shall be resolved in the competent court in Belgrade, Republic of Serbia, except where mandatory consumer-protection law in the tenant's jurisdiction requires otherwise.

For EU/EEA tenants, GDPR-related disputes may be escalated to the relevant supervisory authority in the tenant's member state. For Serbian entities, the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) is the competent authority.

12. Contact & DPO

We reserve the right to update these terms. Material changes will be notified by email to registered admin addresses at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance.