For the CISO
A learning environment without shadow IT.
The Itjoe Portal runs on your own infrastructure, in your own database, without external analytics and without learning data at third parties. Security here is not a paragraph in a processing agreement but a series of design decisions you can find back in the code.
Sound familiar?
A learning platform is often a shadow-IT risk: an external SaaS environment with unknown data processing, weak authentication for administrators and an audit log that only exists once you ask for it.
This platform is built the other way round. Below is what that means in concrete terms, from authentication to audit log. Every measure can be verified, and what we deliberately do not do is listed too.
What you get here
01 · The measures
Your own hosting, your own database
The environment runs on your own infrastructure with its own MySQL database. No external analytics link, no learning data to third parties, no tracking cookies in the course material.
Passkeys mandatory for administrators
Every platform and organisation administrator must register or use a passkey on top of password or SSO. No session exists until that step is complete. The ten recovery codes have their own lockout that never blocks the passkey itself.
SSO on your own Entra ID
Each organisation connects its own app registration. An account is never created automatically: SSO does not replace the invitation, only the password. It can be enforced organisation-wide, with an emergency entrance for platform administration.
Encrypted secrets
Client secrets are stored encrypted with AES-256-GCM, with key derivation via scrypt when no full hex key is supplied.
Hardening of the application
A strict Content-Security-Policy with a per-request nonce and strict-dynamic: no blank cheque for inline scripts. On top of that, two-year HSTS including subdomains, X-Frame-Options DENY, nosniff, a strict referrer policy and a Permissions-Policy that closes off camera, microphone, location, payment API and USB.
Brakes on login attempts
Rate limiting on login, password reset and redeeming access codes. After five failed attempts an account locks for fifteen minutes. That is the layer against password spraying, on top of the passkeys.
An audit log in Entra format
02 · The audit log
What is in it
Who logged in when, what failed and which administrative actions were carried out, with timestamp, actor, IP address and browser. Sign-ins are kept separate from administrative actions, in the same format Entra uses. Filter by category, action and result, and export the selection as CSV for an audit. Retention defaults to ninety days and is freely configurable.
What is deliberately not in it
What a participant reads or completes. That is progress, not a security event, and it is already in the reporting. An organisation administrator also gets a deliberately narrower log: the sign-ins and administrative actions within their own organisation, without IP addresses and without export. When an employer sees which address an employee logs in from, that is surveillance, not administration.
Hard tenant isolation
All administrative queries pass through a single enforcement point. By construction, an organisation administrator can never reach another customer's data or submitted assignments. Not even by typing the right address into the browser bar.
Privacy as a design decision
03 · What we don't do
No time tracking
What is called study load is the summed estimated duration of completed units. Not how long someone sat at their screen. Measuring actual time is the difference between learning and surveillance, so we don't.
An aggregation floor of five
Below five measured participants nothing is broken down anywhere. That floor lives in one place in the code and is deliberately not a per-customer setting: a floor the customer can lower is not a floor.
Uploads outside the project folder
Uploaded files are not publicly reachable. Downloads pass through a route that first checks the visitor is logged in and has access to the training the file belongs to.
Questions
04 · Short answer
Where does the data live?
On your own hosting, in your own MySQL database. There is no external analytics link and no learning data goes to third parties. Videos in the course material run via youtube-nocookie.com or Vimeo with do-not-track on.
Can an administrator work without a passkey?
No. After password or SSO the passkey is mandatory, and no session exists until that step is complete. If an administrator loses their passkey, there are ten recovery codes with their own lockout, so five wrong codes never block the passkey itself.
Does the platform connect to our Microsoft environment?
Only for single sign-on, via your own app registration in Entra ID. Nothing beyond that: no Graph connection, no read access to documents or mail. The click simulations in the course material are screenshots, not a live connection.
Put it next to your own checklist
In a half-hour demo we walk through the authentication, the audit log and the data processing agreement. Bring your own list of questions.