GDPR

Roles

• Self-hosted deployment: you are the controller AND (typically) the processor of your own workspace's personal data. Ithura is a software supplier, not a processor, because Ithura has no access to the data.
• Managed Ithura Cloud: Anorph is the processor and you (the workspace admin) are the controller. The DPA template captures the relationship.

Article 30: Records of processing

For a self-hosted install, the categories of personal data Ithura's schema stores are:

Table (representative)	Personal data	Purpose
users	Email, display name, avatar URL, password hash (bcrypt cost 12)	Authentication and identification
sessions	User ID, IP address, User-Agent, expiry	Session management
workspaces, workspace_members	Membership graph, roles	Access control
issues, comments, activities	Assignee, mentions, content authored by users	Product function
wiki_pages, boards, pages	Content authored by users	Product function
audit_logs	Actor user ID, actor token ID, IP, User-Agent, action, target entity, metadata	Security and compliance
notifications, notification_reads	Recipient user ID	Product function
oauth_accounts	Provider (Google, GitHub, ...), external user ID, email	SSO linkage
two_factor_secrets	Encrypted TOTP secret (AES-256-GCM), backup codes (hashed)	2FA
integrations, instance_configurations	API tokens, webhook secrets (AES-256-GCM at rest)	Third-party integration

Article 32: Security of processing

The measures Ithura implements out of the box:

• Encryption in transit. The API and SPA are HTTPS-only in the reference deployment. Certificates via Let's Encrypt (Traefik) for the managed offering; you choose the terminator when you self-host.
• Encryption at rest for secrets. Every secret field (integration API tokens, webhook secrets, SMTP credentials, OAuth client secrets, 2FA seeds) is AES-256-GCM encrypted with an envelope format enc:v1:<base64url(nonce||ciphertext)>. The key is derived from the SECRET_KEY environment variable via SHA-256. The secrets.MaybeDecrypt helper is applied at every read site so a rotated key can be rolled out incrementally.
• Encryption at rest for the database and object store. Depends on your volume provider. Ithura Cloud uses full-disk encryption on all volumes.
• Password hashing. bcrypt cost 12 for user passwords (stronger than the library default of 10). SSO / SCIM-provisioned users never receive a usable password; a random 32-byte value is bcrypted only to preserve the schema shape.
• Multi-factor authentication. TOTP-based 2FA per user; workspace admins can enforce 2FA for all members ("Two-factor enforcement" on Pro).
• Access control. Role-based access with Admin (20), Member (15), Guest (5). Per-workspace membership; per-project explicit roles that override workspace defaults; wiki collections and pages have their own permission model documented in the Wiki access model guide.
• Session management. HTTP-only, Secure, SameSite=Lax cookies. Session policy on Enterprise: configurable idle and absolute timeouts, session revocation via the API, forced re-authentication on password change.
• Network controls. Workspace-level IP allowlist on Enterprise. A request from an address outside the allowlist is refused with 403, audited, and never touches workspace data.
• CSRF protection via a double-submit token on state-changing routes.
• SQL injection surface. All queries use pgx parameterized queries. No string interpolation into SQL.
• Rate limiting on auth endpoints (login, forgot password, invite accept) via a Valkey-backed sliding-window limiter.
• Audit logging. Every workspace-scoped admin action writes an entry to audit_logs with actor, action, target, IP, User-Agent, and metadata. Writes are best-effort so an audit failure never denies the underlying operation, but each miss is logged. Retention and export to CSV / SIEM are configurable on Enterprise.
• No telemetry to Ithura or Anorph. A self-hosted deployment emits no outbound traffic to Ithura-controlled endpoints. Confirmable by network policy.

Data-subject rights

The rights of access, rectification, erasure, restriction, portability, and objection map to the following product surfaces.

Right	How Ithura implements it
Access (Art. 15)	The workspace API returns every entity the user has authored or is assigned to. Admins can also export the full workspace member list.
Rectification (Art. 16)	Any user can edit their own profile (name, email, avatar). Admins can edit any workspace member's profile.
Erasure (Art. 17)	Deleting a user removes the user row and cascades to sessions, tokens, and OAuth links. Content the user authored (issues, comments, wiki pages) is retained by default (belongs to the workspace) but attribution can be replaced with "Deleted user" via admin action. A hard content-purge flow is on the Enterprise roadmap.
Restriction (Art. 18)	An admin can disable a user (users.is_active = false), which blocks login and API access while preserving the row for lawful retention.
Portability (Art. 20)	Every user's content is reachable via the JSON API with an API token. Workspace-level export is the Workspace File feature (planned).
Objection / withdraw consent (Art. 21)	Notification preferences are per-user; email opt-out honours immediately.

International transfers

• Self-hosted: no transfers unless your admin configured an integration that crosses a border. Configuring, for example, a Slack integration results in transfers to Slack under Slack's own DPA and adequacy mechanism.
• Ithura Cloud: all Anorph infrastructure is in the European Union. The only outbound recipients are Stripe (Ireland, EU) and the SMTP relay. No transfers to a third country under the current setup.

Sub-processors (Ithura Cloud only)

Not applicable to self-hosted installs. For Ithura Cloud:

Sub-processor	Role	Location
Anorph B.V.	Compute, storage, network	Netherlands, EU
Stripe Payments Europe, Ltd.	Payment processing for the managed offering	Ireland, EU
Google Ireland Limited (SMTP relay)	Outbound transactional email	Ireland, EU

Changes to this list are announced with 30 days' notice to affected customers via email and via a change entry in data residency.

Breach notification

Self-hosted: you are the controller; breach notification is your responsibility. Ithura will publish security advisories via the release notes and via a GitHub Security Advisory for any vulnerability in the Ithura code itself. Subscribe to the release feed on /releases.

Ithura Cloud: Anorph will notify affected controllers without undue delay and in any event within 72 hours of becoming aware of a personal-data breach, as required by Article 33.