Infinity security & data handling

Account, workspace and role controls

The public website and file viewer can be reached without signing in. Access to protected account and workspace functions is checked by the server.

What geobrAIn sends for AI processing

When a user submits an AI request, the question, recent conversation history and included well context, document excerpts or images can be transmitted to OpenAI to produce the response. Review the included material and your company’s AI policy before submitting confidential information.

• Saved research: the server applies the user’s access scope before retrieving library material for the assistant.
• Public web research: the current workflow rejects research-mode requests that include attached well context, saved library records or images. Users must also avoid manually entering confidential information into a general web-research question.
• Response storage setting: the application requests store:false. This setting alone does not establish Zero Data Retention, eliminate all provider logging or guarantee processing in Canada.
• Provider terms: OpenAI documents separate abuse-monitoring retention and eligibility requirements for Zero Data Retention. Account-specific settings and contractual terms must be verified for the intended use.

Read OpenAI’s current API data controls. AI output requires geological and operational review before use.

Device drafts, uploads and exported reports

Browser and device storage

Recovery drafts, cached working information and preferences may remain in browser or device storage. Account scoping in the application is not a claim that local drafts are encrypted. Use approved devices, screen locking and your organization’s storage and disposal procedures.

Private files

Protected research uploads are retrieved through account-scoped server checks. A file’s confidentiality also depends on who is granted access and where downloaded copies are kept.

Interactive reports and Infinity Viewer

Exported .gnav packages and standalone HTML reports contain the information included in the export. The public viewer reads the supplied report; opening it does not grant access to an Infinity account. A distributed copy is outside the protection of the account login and cannot be assumed revocable. Review its contents and share it through client-approved channels.

Service providers and responsibility

The reviewed implementation uses Supabase for account authentication, Cloudflare Workers with configured database and object-storage services, and OpenAI for geobrAIn processing. Different information types can follow different service paths. A provider’s certification or general security documentation does not certify the complete Infinity application.

Specific storage regions, encryption-at-rest and key-management arrangements, retention periods and provider agreements must be confirmed for each client requirement. This page does not promise Canadian-only storage or end-to-end encryption. See Supabase’s shared-responsibility guidance.

What has been checked—and what needs confirmation

Before placing confidential client data in Infinity

Ask GeoNavigate to document the requirements that apply to your organization and confirm the corresponding evidence:

1. Who may access each workspace and well, and how is access removed?
2. Which authentication and administrator MFA requirements apply?
3. Where are records, uploads, backups and AI requests processed or stored?
4. What are the agreed retention, deletion, export and recovery arrangements?
5. Which AI use cases and included data types are approved by the client?
6. What independent assessment, incident reporting and support arrangements are required?

For an access concern or security question, contact GeoNavigate / Chaser Geological or email jyoung@chasergeological.com. Describe the issue without sending passwords, access tokens or unnecessary confidential well information.