IthuraDocs
Open app

Answer a sovereign-procurement questionnaire

Time: 15 minutes. You'll need: the workspace-admin role (role 20), the Enterprise plan on the workspace, and a real (or representative) procurement questionnaire from a security or DPO team. If you don't have one, use the five questions in step 1.

By the end you'll have answered a full sovereign procurement pass against Ithura using nothing but the docs, the workspace file, and the admin panel. The point is to demonstrate the answer path end to end, so the next time a real questionnaire lands you know exactly where to click.

1. Line up the questions

If you don't have a real questionnaire, use these five (they cover every common ask):

  1. Where is our data processed and stored?
  2. Show us the sub-processors list.
  3. Can we export the entire dataset in a portable format?
  4. What is the audit-log posture, and can we stream it into our SIEM?
  5. Show us evidence that the release artifacts are signed and that an SBOM is published.

2. Answer "where is data processed" (question 1)

Open the docs at /docs/sovereign/data-residency. The page names the region for Ithura Cloud (EU) and the operator control point for self-hosted. Copy the two paragraphs into the questionnaire's Data Residency section verbatim. This is the answer your DPO wanted.

3. Answer "sub-processors" (question 2)

Open /docs/sovereign/README and follow the sub-processors link. The list is the authoritative one: names, roles, geography, contact for each. Attach the page URL to the questionnaire; it lives on ithura.com, so an auditor can verify it themselves.

4. Answer "portable export" (question 3), the demo-able way

Rather than describing the workspace file, generate one. Open Workspace settings → Exports → New export → Workspace file (SQLite). Wait for the row to flip to completed, then download the zip. Point the reviewer at the Workspace file docs for the 19-table schema. Answer Article 20 of GDPR, section on portability, with: "single-click export at Settings → Exports → Workspace file (SQLite). Example attached; regenerate on demand."

If you want to prove the file is queryable in third-party tools, the first-export tutorial walks through running DuckDB against it.

5. Answer "audit log and SIEM" (question 4)

Open /docs/sovereign/audit-export. The doc explains the streaming CSV endpoint (GET /workspaces/{slug}/audit-logs/export.csv), the retention window, and the filter surface. Paste the endpoint into the questionnaire's Audit section along with the line "Enterprise plan, workspace-admin only. Streamed row-by-row, so a full year of events downloads without a memory spike. Every mutation writes a row."

If your SIEM ingests CSV over HTTPS, that's the wire. If it needs JSON, hit the paginated list endpoint instead; both are on the same row-per-mutation trail.

6. Answer "signed artifacts and SBOM" (question 5)

Open /docs/sovereign/sbom. The doc says every release image ships with a syft-generated SPDX SBOM and a cosign signature, and it shows the two verification commands. Paste those into the questionnaire's Supply Chain section. If the questionnaire also asks about air-gap install, that doc is one link over.

7. Wrap up: the fill-in DPA

If the questionnaire came with a DPA template, or if the reviewer wants to see yours, open /docs/sovereign/dpa-template. The template covers the three common processor scenarios (you host, a partner hosts, Anorph runs Ithura Cloud) with clause-level guidance. Fill in the workspace-specific fields and attach it to the reply.

You've now answered the whole questionnaire in about 15 minutes using only public docs, one export, and the admin panel. That's the sovereign story working the way it was designed to work.

What next