Security
ItemaAI is built with a security-first mindset: strong authentication, controlled sessions, and practical safeguards to reduce risk and protect user data.
Plain-language data policy: How We Use Your Data.
Authentication
Email Registration
User registration with email verification.
Password Security
Password strength validation + bcrypt hashing.
MFA (TOTP)
Authenticator app support + MFA backup codes.
Account Recovery
Password reset via email verification + backup codes.
Sessions + API Security
JWT Tokens
JWT auth with refresh tokens and expiration handling.
Rate Limiting
Rate limiting on API endpoints to reduce abuse.
Lockout Protection
Account lockout after repeated failed login attempts.
CORS Controls
Origin validation and CORS configuration.
OAuth Flow
OAuth authorization flow for third-party integrations.
Security Headers
CSP, X-Frame-Options, HSTS and related middleware.
Token Expiration
Session management with token expiration.
Monitoring + Logs
Operational logging for troubleshooting and security.
Encryption
In Transit
HTTPS/TLS encrypted communications.
At Rest
Encrypted storage practices for persisted data.
Tenant Isolation (Planned)
Multi-tenant boundaries and org controls are planned next.
Data Ownership
Your data is yours. Export and delete anytime.
Privacy-first by default.
We don’t sell or share your inventory data. We don’t use your data to train AI models.