Security & trust

Security controls, without the hand-waving.

This page describes controls implemented in Itemra today. It is a technical summary, not a certification, contractual guarantee, or substitute for a customer security review.

Implemented now

Controls visible in the application and deployment code.

Identity

WorkOS authentication and server-side sessions

Itemra uses WorkOS for identity flows. Session cookies are HttpOnly and SameSite=Lax, with Secure enforced in deployed environments. The API revalidates the signed-in principal against an active server-side session on requests.

Requests

CSRF protection for browser writes

Protected browser operations validate an antiforgery cookie and X-CSRF-TOKEN header pair before the request reaches application behavior.

Tenancy

Tenant scoping, RBAC, and audit events

Application behavior resolves an organization-scoped tenant and actor context. Permission checks enforce built-in and custom roles, while security-relevant and operational changes produce tenant-scoped audit events.

API

HMAC-derived API-key verification

Customer API keys are generated from cryptographically random bytes. Itemra stores an HMAC-SHA-256-derived value rather than the issued secret and compares verification results in fixed time.

Files

Private blobs and scoped access grants

Attachment storage creates blob containers without public access. Upload and download grants are short-lived, single-blob SAS URLs with narrowly separated write or read permissions.

Runtime

Protected framework keys and non-root containers

ASP.NET Core Data Protection uses an Itemra-specific application name and supports shared key persistence in private blob storage when configured. API, public API, worker, and production marketing containers run as non-root users.

Audit evidence

Tamper evidence, with clear boundaries.

Ordinary product operations only append audit events and do not edit or delete individual events. The dedicated retention worker deletes events only after the configured cutoff. SQL Server, backup procedures, and access controls protect the underlying records.
An audit export is point-in-time evidence for the selected scope and period. Customer-configured retention determines how long audit events remain available.
Itemra does not currently claim a cryptographic hash chain, a WORM storage guarantee, or independently verifiable tamper proofing.

AI and customer data

No external LLM data path

The current Itemra product does not integrate an external large language model and does not send customer inventory or operational data to an external LLM.

Planned production topology

Not active production

The planned topology places web and application services on Coruscant and SQL Server on Dagobah. This is a plan, not a statement that production hosting, network controls, backup operations, or external availability have been activated or independently verified.

Assurance boundary

Claims we do not make.

These statements keep implementation evidence separate from future operational or third-party assurance work.

No SOC 2 or ISO certification is claimed.
No data-residency region, including EEA-only residency, is promised.
No blanket encryption-at-rest or encryption-in-transit assurance is published here.
No backup guarantee, restore objective, RPO, or RTO is published.
No uptime percentage or contractual SLA is published.
No claim is made that MFA is enforced for every account.
No independent penetration-test result is claimed.

Security review

Need to review a specific control?

hello@itemra.io Privacy policy Terms of service