Security & trust

Security controls, without the hand-waving.

This page describes controls implemented in Itemra today. It is a technical summary, not a certification, contractual guarantee, or substitute for a customer security review.

Implemented now

Controls visible in the application and deployment code.

Identity

WorkOS authentication and server-side sessions

Itemra uses WorkOS for identity flows. Session cookies are HttpOnly and SameSite=Lax, with Secure enforced in deployed environments. The API revalidates the signed-in principal against an active server-side session on requests.

Requests

CSRF protection for browser writes

Protected browser operations validate an antiforgery cookie and X-CSRF-TOKEN header pair before the request reaches application behavior.

Tenancy

Tenant scoping, RBAC, and audit events

Application behavior resolves an organization-scoped tenant and actor context. Permission checks enforce built-in and custom roles, while security-relevant and operational changes produce tenant-scoped audit events.

API

HMAC-derived API-key verification

Customer API keys are generated from cryptographically random bytes. Itemra stores an HMAC-SHA-256-derived value rather than the issued secret and compares verification results in fixed time.

Files

Private blobs and scoped access grants

Attachment storage creates blob containers without public access. Upload and download grants are short-lived, single-blob SAS URLs with narrowly separated write or read permissions.

Runtime

Protected framework keys and non-root containers

ASP.NET Core Data Protection uses an Itemra-specific application name and supports shared key persistence in private blob storage when configured. API, public API, worker, and production marketing containers run as non-root users.

Audit evidence

Tamper evidence, with clear boundaries.

Ordinary product operations only append audit events and do not edit or delete individual events. The dedicated retention worker deletes events only after the configured cutoff. SQL Server, backup procedures, and access controls protect the underlying records.
An audit export is point-in-time evidence for the selected scope and period. Customer-configured retention determines how long audit events remain available.
Itemra does not currently claim a cryptographic hash chain, a WORM storage guarantee, or independently verifiable tamper proofing.

AI and customer data

No external LLM data path

The current Itemra product does not integrate an external large language model and does not send customer inventory or operational data to an external LLM.

Production hosting

Hosting, backups and recovery

Itemra operates application services on a single host in Norway. The primary database and uploaded files use Azure SQL Database and Azure Blob Storage in Norway East. Database recovery uses point-in-time and long-term backups. Application-host recovery requires repair or redeployment; there is no automatic compute failover. Support is provided on a best-efforts basis.

Assurance boundary

Claims we do not make.

These statements keep implementation evidence separate from future operational or third-party assurance work.

No SOC 2 or ISO certification is claimed.
EEA-only processing is not promised. Provider locations and transfer arrangements are listed in our subprocessor list.
No blanket encryption-at-rest or encryption-in-transit assurance is published here.
No backup guarantee, restore objective, RPO, or RTO is published.
No uptime percentage or contractual SLA is published.
No claim is made that MFA is enforced for every account.
No independent penetration-test result is claimed.

Security review

Need to review a specific control?

hello@itemra.io Privacy policy Terms of service