Security & privacy

itcmdr is built for offices that handle sensitive data, so privacy is the default, not a setting.

What stays in the office

Everything the agents collect goes to the site server in the office.
Backups stay on the site server. There's no restore from the admin server, and tests check that no backup bytes or key material cross the link.
If you connect an admin server, the site sends only opaque site-scoped IDs, alert codes, check and plugin names, severity, counts, timestamps and numeric rollups. Anything else is hashed. Tests check that no hostnames, IPs, paths or usernames leave.
Display names are shared only after the owner turns it on for that site.

A 24-word master key, shown once at setup, backs certified keys for every user.
Every request to the server is signed, and every change goes to an audit log.
The database is encrypted and its key is escrowed under the 24 words.
On the admin server, passkeys or security keys can be required as a second factor, and audit entries are signed and hash-chained.

Agents enroll with one-time tokens and pin the server's certificate.
Every connection uses TLS 1.3 with mutual certificates from the site's own CA. No public CA is involved.
Certificates renew automatically, and revoked agents are refused during the handshake.
Plugins are signed and checked against checksums. Tampered packages are quarantined.

Only allowlisted commands can be sent. They come with a preview and two-person approval, and the site owner can freeze them at any time.

Please report security issues privately through GitHub.