Security and operations
Where your data is held,
and who can get at it.
An inventory list records valuables and the names of the people who currently have them. It belongs on a server someone can give account of. Here is what we do and what the data centre does.
Member of Swiss Label
Swiss Made
Inventaris is developed and maintained in Switzerland.
Swiss Services
Support and care from the team that builds Inventaris. Whoever writes to us speaks with people who know the software inside out.
Swyron GmbH, 8374 Oberwangen TG · Member of Swiss Label
In the application
What we are responsible for ourselves.
Separate data spaces
Every organisation works in its own data space. The separation is enforced centrally: a query without an organisation check is rejected before it reaches the database.
Roles and rights
Owner, administrator, manager, employee, borrower, kiosk, plus students with the library. Each person sees only the functions their role allows.
Two-step sign-in
Mandatory for owners and administrators, available for everyone else. Time codes per RFC 6238, plus ten backup codes in case the phone is ever missing. Accounts with Microsoft sign-in use Microsoft's second step.
Sign out on inactivity
After 15 minutes without use the session ends. That keeps the computer in the staff room protected too when someone steps away for a moment.
Sign-in via Microsoft 365
Whoever has a tenant connects it and assigns the rights via security groups. When someone leaves, the directory withdraws access, without anyone having to think of it.
Traceable
Changes to inventory, loans and accounts are logged, with person, time and previous state.
Beneath the surface
The four details asked for in every procurement.
- Transmission
- Encrypted only. Unencrypted requests are redirected.
- Passwords and access credentials
- Never stored in plain text and appear in no log.
- Photos
- Reduced in size on upload and stripped of capture data. That way, for example, the location where a phone photo was taken stays private.
- Backup
- Every night a full backup, checked and encrypted before the old one is cleared away; the key is not on the server. Daily for fourteen days, then monthly for a year.
We do not publish here which procedures work in the background or what the data storage looks like in detail. Whoever needs the details for a good reason, for an audit say or for an IT department before signing, gets them from us: in writing and under confidentiality.
Swyron AI with guard rails
Booking the Swyron AI add-on gives you help with fixed limits. What leaves is pseudonymised, and anything that has nothing to do with Inventaris never gets through.
- Your question You ask in the Swyron AI field, for example “Where is the projector for room 12?”.
- Pseudonymisation Inventaris replaces names, email addresses and phone numbers with random placeholders that change with every conversation, before anything leaves Brazil. Staff numbers never leave at all.
-
Swyron Guard
Checks every question before Swyron AI sees it: a separate, small model with no tools and no access to the inventory.
- Questions about your inventory
- Help with device problems
- General knowledge and homework
- Texts, emails and research
- Attempts to get round the rules
- Swyron AI A language model from an external provider in the USA. It only reads, only your own organisation and only what the person asking is allowed to see.
- Answer Inventaris puts the names back. The answer is marked as AI and can be reported.
The data centre
Inventaris runs on servers in a data centre in São Paulo, Brazil, described below. We will state the name of the operator on request.
These certificates belong to the facility our servers stand in and do not relate to the software running on it. What we do is stated further up.
- ISO 27001 The data centre in São Paulo is a Tier III facility: power and cooling are redundant, and maintenance does not interrupt operation.
- FINMA Circular 08/07 The facility meets the requirements for outsourcing by banks and is accordingly described by the operator as FINMA-compliant.
- Access and fire protection Access controls, several separate fire protection zones and monitoring around the clock, every day of the year.
- Power Redundant power supply with an autonomous backup supply. If one grid fails, operations do not stop.
Report a vulnerability
Please write to us first, before you pass it on. We reply on working days within a day, and someone who wrote the code gets in touch.
- An answer within a day On working days and directly from someone who knows the code. You get an answer on the matter itself, with no ticket system in between.
- Reports in good faith Whoever reports a vulnerability to us in good faith and gives us time to close it can expect no legal action from us.
- What we ask Do not download other people's data, do not disrupt operations, leave other people's accounts alone. A description of the route is enough.
Security standards put the inventory first
The CIS Critical Security Controls, used worldwide, begin with an inventory of all devices: Control 1. All other measures build on it.
A measure can only be chosen appropriately once the inventory is in place. Whoever knows which devices they have, where they are and who is currently using them can protect them and notices when one is missing. Every further step builds on this.
- 1 Identify Knowing what you have: devices, data, responsibilities.
- 2 Protect Access, encryption, maintenance, training.
- 3 Detect Noticing anomalies before they cause harm.
- 4 Respond Containing an incident and working through it.
- 5 Recover Bringing operations back and learning from it.
What Inventaris contributes to this
Every device recorded individually, with its own inventory number, serial number, location and acquisition value. Who had it and when is in the device's history. The inventory check shows what has changed since the last count, and the connection to Intune, Jamf or Mosyle keeps track of the stock without anyone typing it in.
In context
Inventaris is not proof that the standard is met. The standard covers five functions and far more than an inventory: access protection, detection, incident response, recovery. Inventaris covers part of the first step, cleanly and traceably. The other functions require further measures.
Who the standard applies to
For a school, a municipality or a company the controls are voluntary and a useful yardstick for where to begin.
And for everyone else
Alongside the minimum standard for critical infrastructures, the BACS publishes the Cybersecurity and Resilience Method. It is aimed at organisations of any size and sector, so at a school or a municipality too. It guides you in five steps, and the second reads: determine the IT resources that serve the important activities.
This is where Inventaris comes in. Step one, determining the important activities, remains with you. For step two the application provides the register of IT resources, and from step three on you know what you are deciding about.
We are happy to advise you!
Trial access, a personal presentation or a short call: choose whatever suits you.
Your data belongs to you
We do not sell your data, do not pass it on and do not exploit it for other purposes. We process it as a processor (operador) under the Brazilian General Data Protection Law (LGPD). The contract is subject to Brazilian law.
An export as CSV is available at any time, without asking and without a reason for cancelling. If you switch, you take your data with you.