Security & Trust

Security & Trust

A concise view of controls that are implemented today, how the assessment handles data, and what ITONKA does not yet claim.

Effective September 21, 2026 · ITONKA Inc. operates the ITONKA website, assessment and client platform.

Current security posture

Server-side authenticationThe protected Platform login is enforced by the server before the application is delivered.
Secure sessionsAuthentication sessions use HTTP-only cookies, SameSite=Strict and the Secure flag when served over HTTPS.
CSRF protectionLogin submissions are validated with a server-generated anti-CSRF token.
Password protectionPlatform sign-in validates credentials against a password hash rather than storing the password in page code.
Browser framing controlThe protected Platform sends SAMEORIGIN frame protection to reduce clickjacking exposure.
Search exclusionProtected Platform pages are marked noindex/nofollow and are not intended for public indexing.

Assessment privacy by design

The free AI Investment Decision Assessment runs in the browser. Individual answers are not sent to ITONKA when you calculate a score. A summary is transmitted only if you choose to submit the result. See the Privacy notice for details.

Public forms

Public contact and optional assessment submissions currently use FormSubmit as a form-transmission service. Do not send confidential or regulated information through a public website form.

What we do not claim

ITONKA does not currently claim SOC 2, ISO 27001 or another independent security certification on this public site. The free assessment is not an audit, assurance opinion or peer benchmark. We will publish certifications only after they are formally obtained.

Enterprise security

Enterprise requirements such as identity integration, user lifecycle controls, data residency, retention, contractual security obligations, evidence storage and integration permissions should be confirmed during implementation and documented in the applicable customer agreement.

Responsible disclosure

To report a suspected security issue, contact info@itonka.com with enough detail for us to investigate. Please do not include unnecessary sensitive data in the initial message.