Defense in depth
Every layer, independently secured
Security posture
Updated October 2026
Security is a posture, not a feature.
Every Infraxeon product is built with the same defense-in-depth architecture as the financial systems we integrate with. Identity, audit, encryption, and isolation are load-bearing primitives, not bolt-ons.
01
02
Least privilege
Eight roles, granular scope
03
Immutable audit
No UPDATE, no DELETE
04
Out of scope
No cards, no payroll PII
Defense in depth
Four walls around your data.
Every request crosses four independently secured layers before it touches anything that matters, and the most sensitive data never enters the building at all.
a request from the outside world
01 · EdgeCloudflare: DDoS · WAF · SSLblocks floods, bots & known exploits
02 · IdentitySSO / OIDC · MFA · eight role tiersblocks stolen passwords & over-reach
03 · ApplicationOrg-scoped queries · re-auth on privileged actionsblocks cross-tenant access (IDOR-tested)
04 · DataAES-256 at rest · row-level isolationblocks offline theft & tampering
Your data
per-tenant · encrypted · immutable 7-year audit
Never inside these walls
✕Card data: tokenized, lives at Stripe
✕Payroll PII: stays with your payroll provider
✕Bank & tax IDs: never touch the platform
Each layer is secured independently; a failure in one is caught by the next. The safest data is the data we never store.
Five commitments
How we think about security.
Not a compliance checklist. These are the design decisions we make every time we choose between convenience and the right thing.
01
Encrypt everything, always
TLS in transit, AES-256 at rest, passwords and tokens hashed, secrets centrally rotated. Nothing we store or send ever sits in the clear. The algorithm-by-algorithm detail is below.
02
Isolate by default, share by exception
Tenant data is isolated on every query: mandatory org-context, unconditional org scoping, and composite org+location keys. Isolation is regression-tested against IDOR, not just intended.
03
Log everything. Delete nothing
Every mutation logged with actor, timestamp, IP, and before/after state. The audit table has no UPDATE or DELETE, not even for platform admins. Seven-year retention enforced at the database level.
04
Least privilege, always
Granular role tiers from Crew to Platform Admin. Permissions are hierarchical, location-scoped, and time-boundable. Every privileged action requires re-auth. No shared credentials, ever.
05
Fail safely, recover cleanly
If the platform is temporarily unavailable, the POS keeps operating. Redemptions fail safely. Managed database failover with point-in-time recovery within 7 days and encrypted off-site backups.
Encryption
What’s encrypted, how.
Every data category, every hashing algorithm, every rotation cadence, documented so your security team doesn’t have to ask.
The encryption table 8 data categories: algorithm, key length, and posture Show detail
| Data category | Algorithm | Posture |
|---|---|---|
| API traffic (all endpoints) | TLS 1.2+ | Enforced |
| Database at rest | AES-256 | Enforced |
| Backups at rest | AES-256 | Enforced |
| User passwords | bcrypt (12 rounds) | Hashed |
| API keys (POS integration) | SHA-256 | Hashed |
| QR redemption tokens | SHA-256 + 5-min TTL | Single-use |
| Session tokens | JWT · HS256 | Auto-expiry |
| Environment secrets | Centrally managed | Rotatable |
Access control
Who can do what.
Eight role tiers, hierarchical, location-scoped, from Crew to Platform Admin. Every action is governed by a permission that maps to a role.
The eight role tiers Crew → Platform Admin, and the scope each one carries Show detail
| Tier | Role | Scope |
|---|---|---|
| 01 | Crew | Own wallet & redemption only |
| 02 | Supervisor | Issue rewards, view team, single location |
| 03 | Manager | Approve rewards, manage employees, single location |
| 04 | General Manager | Full location operations, reports, audit view |
| 05 | Regional | Multi-location, cross-property analytics |
| 06 | Org Admin | All locations in org, configuration, integrations |
| 07 | Finance | Read-only audit & financial reporting, all orgs |
| 08 | Platform Admin | System-wide; every action logged & dual-control |
Infrastructure
Secure by design.
Built on boring, battle-tested infrastructure. Every component below is chosen for audit-ability as much as performance.
001
Edge protection
Cloudflare handles DDoS mitigation, WAF rules, bot management, and SSL termination. Origin IPs are never exposed. Zero Trust Access is SSO-integrable on request.
002
Single sign-on
OpenID Connect / OAuth 2.0 for Okta, Microsoft Entra (Azure AD), and Google Workspace, per-org. MFA enforced at the IdP layer. SAML on the roadmap.
003
Session management
JWT-based with configurable TTL (default 8 hours). Concurrent session limits, forced re-auth on privileged actions, and server-side invalidation on logout.
004
Penetration testing
Third-party security assessments scheduled annually. In-house static analysis and dependency scanning on every commit. Critical CVEs patched within 24 hours.
005
Backups & recovery
Daily automated backups with point-in-time recovery up to 7 days. Weekly encrypted off-site snapshots. Recovery procedures documented and tested quarterly.
006
Observability
Structured logging across every service. APM with anomaly detection. Alerts wired to an on-call rotation, so incidents surface before they reach you.
Reliability
When things go wrong.
Targets and recovery times for every failure mode we’ve anticipated. The restaurant keeps running either way.
Failure modes & recovery targets Uptime SLA, failover, and data-loss bounds per scenario Show detail
| Failure mode | Target | Recovery |
|---|---|---|
| Uptime SLA | 99.5% | Excluding scheduled maintenance windows |
| Container failure | Auto-recovery | < 5 min (health-checked restart) |
| Database incident | Managed failover | Point-in-time recovery within 7 days |
| Region outage | < 24 hr data loss | Restore from encrypted off-site backup |
| Platform unavailable | Graceful fail | POS continues; redemptions queue safely |
Scope
What we don’t store.
The safest data is the data we never touch. Infraxeon is an operational intelligence platform, not a payment processor, not a payroll system, not a guest data warehouse.
Payment card data
No cardholder data stored, processed, or transmitted. Not in PCI DSS scope. Card payments (for gift cards) run entirely through Stripe Checkout, the card never touches our servers.
Payroll PII
No SSNs, tax withholdings, net-pay computation, W-2/W-4/1099 data, direct-deposit info, or wage rates. Hours and tips export read-only to your payroll provider, where processing occurs.
Guest / customer data
No guest PII, no check-level guest data. The platform is employee-facing; gift-card recipient email is used for delivery, then purged per retention policy.
Compliance
Frameworks we design toward.
Honest status. We align with recognized frameworks even where we’re not formally certified, because the controls are the right thing to do either way.
| Framework | Applies to | Status |
|---|---|---|
| SOC 2 Type II | Security, availability, confidentiality controls | Architected for |
| PCI DSS | Cardholder data handling | Out of scope |
| GDPR | EU personal data processing | Aligned |
| CCPA | California consumer privacy | Aligned |
| NIST 800-53 | Federal security controls baseline | Reference |
| OWASP Top 10 | Application security hygiene | Continuous |
For your security team
Request the full security packet.
Architecture diagrams, threat model, data flow, DPA, and incident response plan, available under NDA for active evaluations.