Itemeyez / The details
Security.
Protecting your information starts with clear limits and careful handling.
Website and workspace protections
The public website uses HTTPS. Device records stay in your browser; they are not automatically uploaded. Example records and your own records are separate workspaces. Save exports somewhere private.
Account-enabled workspaces use access rules tied to the signed-in account and private receipt storage. New accounts confirm their email before opening a private workspace. Known leaked passwords are rejected when choosing a password. Owner access is assigned on the server; a browser setting does not grant it.
The infrastructure behind Itemeyez
Itemeyez runs on established cloud hosting and account services. Our providers publish independent security assessments and certifications for their own services, including SOC 2 Type 2 reports and ISO 27001 certifications. You can review the hosting provider’s compliance resources and the account and storage provider’s security information.
These assessments cover the providers and the services named in their reports. Itemeyez remains responsible for its application, access rules and data handling. Itemeyez has not received its own SOC 2 attestation or ISO 27001 certification. We display an outside trustmark only after meeting its requirements and while its status remains valid.
TrustedSite checks
On October 22, 2026, itemeyez.com earned TrustedSite Certified Secure and Verified Business. Certified Secure checks for malware, malicious links, phishing and blacklist issues and repeats weekly. Verified Business confirms our email and hosted contact-form channels. View the current certification status.
These limited vendor checks are not a full application audit, a guarantee of security, or a review of private account isolation or legal compliance. The optional floating badge is shown only with its separate privacy permission and is subject to the free-plan visit limit. Itemeyez has not earned the paid Data Protection, Issue-Free Orders or other Pro certifications.
Future paid checkout
Public paid plans are not available yet. When they open, checkout will be handled by Stripe on its hosted payment page. Itemeyez will not store your full card number or card security code. Stripe can send us payment status and limited billing details to manage access and support. Stripe privacy information.
Stripe maintains its own payment-security controls. Its compliance does not make Itemeyez independently certified or remove our responsibilities. We do not display a payment trustmark as a guarantee against fraud or payment disputes.
Spam and misuse protections
We limit repeated account and website requests, keep a wait between account emails, and check requests before saving them. Limits can briefly pause unusually busy activity. Public sign-in and reset screens use general messages instead of exposing account status or provider diagnostics.
Our website uses short-lived, hashed network tokens for abuse limits. They are separate from optional analytics and are not linked to your account or private records. No raw IP address is stored in these counters. See Hosting and security for details.
Security standards
We use OWASP application security guidance and NIST small-business guidance as references for security work.
Itemeyez does not claim a SOC 2 attestation, ISO 27001 certification, or PCI validation. A hosting or account provider’s certification does not certify Itemeyez. No service can promise complete security.
Your part
Use a unique password and protect the email connected with an account. Sign out on shared devices. Keep exported reports and receipts private, and avoid entering unnecessary personal information.
Do not send passwords, full payment card details or sensitive receipts in a support email. We do not ask for your password by email.
Report a security concern
Email help@itemeyez.com with “Security report” in the subject. Include the affected page and safe steps to reproduce the issue. Do not access another person’s records, disrupt the service, or attach live credentials.
We investigate reports and take appropriate action. We provide notifications required by law when a security incident affects personal information. Sending a report does not authorize testing beyond information and systems you are allowed to access; no paid bug bounty is offered.