Security & privacy

Your data, protected in the EU

TomIT is built with privacy and security first — workspace isolation, encryption, audit trails and GDPR-friendly hosting, out of the box.

EU hosting & GDPR

Everything runs on EU infrastructure under EU rules (GDPR). Your data stays in the EU and is never used to train public models or shared with other workspaces.

Workspace isolation

Every workspace is isolated at the database level — there is no way for one workspace to see another's data, and every query is scoped automatically.

Encryption at rest & in transit

All traffic is TLS-encrypted. Sensitive credentials (SMTP, integration keys) are encrypted at rest with AES-256-GCM, and nightly backups are GPG-encrypted.

Role-based access

Owner, superadmin, admin, KB admin, user and agent roles — each with a strictly scoped view. Users only see assets assigned to them.

Full audit trail

Every change to an asset is recorded with the old and new values, who did it, and when — by people or by agents. Sensitive actions land in a separate admin audit.

Backups & recovery

Encrypted backups run every night and are kept on the server. The demo workspace is reset nightly so you can explore freely.

Data export & deletion

Export your data to CSV, Excel or PDF any time. If you leave, your data goes with you — no lock-in.

Secure sessions

Login sessions are HttpOnly, SameSite cookies with revocation on password change or logout. API access is key-based and audited.

Workspaces, fully isolated

One platform, many workspaces — zero overlap

Every workspace gets its own fully isolated data scope. A user in one workspace can never read, search or export another workspace's devices, contracts or users — verified continuously, not just promised.

  • Database-level isolation on every query, automatically
  • Cross-workspace access attempts are rejected (verified 404/empty)
  • Roles are enforced per request — not just hidden in the UI

Security at a glance

HostingEU (GDPR), TLS everywhere
Secrets at restAES-256-GCM encrypted
BackupsDaily, GPG-encrypted
SessionsHttpOnly SameSite cookies + revocation
AuditEvery change, old & new values
Data residencyYour data stays in the EU

Security you can verify, not just read about

Start free and check the audit trail, the isolation and the exports yourself.