Sovereign data. Auditable controls.

Architectural sovereignty

LinaDesk deploys as a single .NET service against a SQL Server database, both running on your infrastructure. There is no vendor cloud dependency in the runtime path. The product never phones home. There is no telemetry, no crash reporting to third parties, no license validation call over the internet.

GDPR alignment

Because LinaDesk data stays within your GDPR-controlled infrastructure, most Article 28 processor obligations do not apply — LinaSource is a software vendor, not a data processor.

Data subject rights implementation

• Right of access (Art. 15): GET /api/me/activity exports a user's complete audit trail in JSON.
• Right to erasure (Art. 17): /utilities panel supports soft-delete with cascade and permanent purge with recovery-window control.
• Data portability (Art. 20): CSV export on every table (tickets, assets, contracts, KB, users).
• Right to object (Art. 21): Notification preferences per-event, per-user; digest rollup as opt-out.
• Records of processing (Art. 30): Immutable audit log tracks every insert / update / delete with actor, timestamp, and old/new values.

KVKK (Türkiye) alignment

LinaDesk was built in Türkiye against KVKK 6698 sayılı kanun requirements. Practical implications:

• Yurt içinde saklama — veriler kurumun kendi sunucusunda; VERBIS bildirimlerinde bulut aktarım kalemleri boş kalır.
• Envanter hazırlığı — kişisel veri kategorileri (isim, e-posta, IP, telefon) ürünün veri modelinde etiketlidir.
• İmha zamanı — soft-delete + purge sweeper yıllık kişisel veri saklama süresi disiplinine uygun otomatikleştirilebilir.
• Denetim izi — 6698 sayılı kanunun 12. maddesi kapsamındaki teknik tedbirler için sistem AuditLog tablosunda kalıcı iz tutar.

ISO/IEC 27001 oriented controls

Although LinaSource does not hold an ISO 27001 certificate for the software product itself, LinaDesk implements controls that map to the standard's Annex A:

Authentication & identity

• Local passwords: Argon2id (memory 64MB, parallelism 4, iterations 3) with per-user salt.
• Active Directory: Native LDAP bind (no NTLM), multi-domain support with domain selector.
• Windows SSO: Negotiate (Kerberos + NTLM fallback).
• Two-factor: TOTP (RFC 6238) with 10 rescue codes; enforced via role policy.
• API keys: Rotatable, per-user, rate-limited (60/min per key).
• Session: HttpOnly, SameSite=Strict cookies; anti-forgery header on every mutation.
• Lockout: After 5 failed attempts, exponentially backoff up to 15 minutes.

Audit logs & forensics

Every insert, update, and delete against any auditable table produces an immutable AuditLog row containing: actor user, timestamp UTC, entity type, entity id, field name, old value, new value, IP address, and department scope anchor.

Audit rows follow the same department-scope filter as source entities. A row can be read only by roles that could see the underlying entity — no bypass through the audit viewer.

The audit table cannot be updated or deleted through the API. Truncation is prevented at the domain layer.

Encryption & secrets

• At rest: SQL Server Transparent Data Encryption (TDE) recommended for regulated environments. Argon2id password hashes need no additional encryption.
• In transit: HTTPS enforced via HSTS 1-year + preload + include-subdomains. TLS 1.2 minimum, TLS 1.3 supported.
• Secrets on disk: DPAPI-encrypted secrets.config for SMTP, webhook secret, TLS private key on Windows deployments. Linux deployments use a passthrough abstraction (audit-visible).
• Webhook signing: HMAC-SHA256 with per-webhook rotatable secret. Verify via X-LinaDesk-Signature header.

Endpoint agent & remote support

The agent is the part of LinaDesk that runs on other people's machines, so its defaults are the strictest in the product.

• Enrollment is not open: a device registers only with a shared enrollment secret (X-Enrollment-Secret), compared in fixed time. If the secret is not configured, enrollment is closed and the server says so — an unconfigured install is not an open one.
• The agent's identity is encrypted at rest: the device token is stored DPAPI-protected under %ProgramData%, readable only by SYSTEM and local administrators.
• Remote support needs the consent of the person at the screen: the agent shows a dialog in the user's own session and reports the answer to the server, where the tunnel is gated on it. Silence is not consent, and a machine with nobody logged in is never opened. A refusal is reported too, so the technician sees “refused” rather than a timeout.
• The consent decision lives on the server, not the client: even a compromised agent cannot open a session the server has no consent record for.
• Network discovery is passive: the agent reads its own ARP cache and emits no traffic. There is no ping sweep and no port scan — nothing your security team's IDS will read as an attack. Discovery is off by default.
• Licence enforcement is offline: the licence file is verified by ECDSA P-256 signature before it is parsed. An unverified licence grants zero seats and zero endpoints rather than being trusted.

Vulnerability program

Responsible disclosure: [email protected]. We respond within 72 hours and target patch delivery within 30 days for critical issues.

Dependency scanning: Continuous scanning of the .NET package tree via dotnet list package --vulnerable in CI.

Static analysis: Roslyn analyzers enforced at build time. No suppressions in checked-in code.

Security reviews: Each release phase closes with an independent security review report published to the internal wiki (customer copies available under NDA).