Security and access
Built so that nobody can change anything in silence
InfraHarbour holds the keys to your domains. So you decide exactly who may see and do what, sign-in is strong, and everything that is done can be followed afterwards.
The right person, the right domain
Users are invited and given a role: owner, administrator, editor, reader — or a role you put together yourself. Access can be limited to single domains, groups or projects, so a client or freelancer only sees their own.
Sign-in that holds
Add passkeys — on your computer, phone or a security key — and two-factor with an authenticator app, with recovery codes in case the phone goes missing. You manage it all yourself on your account page. Passwords are never stored in plain text, and repeated failed attempts are slowed down.
The keys are encrypted
The API keys to your providers are encrypted with AES-256-GCM before they are stored. Read access is enough for most of it, and write access is only needed where you want approved changes to be carried out.
AI agents on a leash
An agent can get a key of its own that may only create proposals — never approve or carry them out. Keys can be revoked at any time.
Everything can be seen afterwards
The activity log shows every decision and who made it. The API log shows every call made with a key, every change and every refused action for 30 days, with the request and the answer — sensitive values masked.
Found a security hole?
Write to contact@infraharbour.com. We reply quickly and keep you informed while we fix it. Do not test against other customers’ accounts or data. The contact details are also in /.well-known/security.txt.
Accounts are kept apart
Every account is separate from the others, and every database query is limited to the account’s own data. InfraHarbour runs on Cloudflare, and the database is in Western Europe.
More features
See your own domains in InfraHarbour
We walk through the panel together with your providers connected — read access only, nothing changed.