Company separation
Every request is checked against the signed-in company, and automated tests check that one company cannot read another company’s data.
Security
Security built in, and explained openly
Built so one company can never see another, and so a stolen PC or password does as little harm as possible. Here is exactly what is in place today.
Controls
How your data is protected
Passwords
Stored only as salted scrypt hashes. Nobody, including the ITCore team, can read them.
Sessions
An HttpOnly cookie that page scripts cannot read. It lasts 7 days and the server keeps only its hash.
Sign-in protection
After too many wrong attempts, sign-in pauses for 15 minutes.
Audit log
Sign-ins and admin changes are recorded with who, what, when and the IP address.
Device credentials
Each PC gets its own credential, encrypted by Windows (DPAPI). Removing the PC in ITCore cuts it off.
Windows app
What the Windows app sends, and what it never collects
We publish this so you can explain it to your staff.
Sent to your company’s ITCore
- PC name and signed-in Windows user
- LAN IP addresses and Windows build
- ITCore app version
- CPU, memory and disk use
- Network, Microsoft Defender, firewall and pending-update status
- Results of an internet test IT started
Never collected
- Screenshots or screen recordings
- Files or documents
- Keystrokes or passwords
- Browsing history
- Control of the screen or keyboard
Remote actions
Two remote actions, with clear limits
Everything else stays on the PC. Both actions travel in the PC’s own regular check-in, over HTTPS.
Restart a PC
IT admins only. The person at the PC sees a 5-minute warning before Windows restarts. A restart can be cancelled before it is delivered, and a company rule for long-running PCs is off until an admin turns it on.
Test the internet connection
IT admins and technicians. 30 pings to the router and to the internet at the same time; the targets are fixed in the app. A request that is not picked up expires after 10 minutes.
Infrastructure
Nothing for you to host or patch
Cloud service
ITCore runs in the cloud. Your staff, IT team and PCs connect over HTTPS.
Encrypted in transit
Every page, API call and PC check-in uses HTTPS.
Updates without work
The web app is always current, and the Windows app updates itself.
Questions
Security questions, answered
Can IT see my screen or files?
No. The Windows app reports the PC’s details and health only. It has no screen sharing, file access or keyboard control. For remote help, IT uses its own tool (for example AnyDesk); ITCore only stores the ID on the ticket.
What can IT do to a PC from ITCore?
Two things: restart it after a 5-minute on-screen warning (IT admins only), and run an internet test of 30 pings to the router and the internet (IT admins and technicians). Nothing else can be started remotely.
Who can see our company’s tickets and devices?
Only people signed in to your company, and only what their role allows: users see their own tickets, managers can read but not change. Each request is checked against the signed-in company on the server.
What happens when a PC is lost or replaced?
Remove it on the Devices page. Its credential stops working at once, and the enrollment token used to set it up is never stored on the PC.
Do we need to run servers?
No. ITCore is a cloud service served over HTTPS. There is nothing to host or patch on your side.