TRUST CENTER

Trust is earned in public.
This is our public ledger.

Independent audits underway. A real vulnerability-disclosure policy. Bug bounties that mean something. Every advisory we publish, in one place.

We will not sue researchers

Good-faith security research is protected. Our disclosure policy is a binding promise, not a marketing line.

We will respond inside 72 hours

First human reply, including a tracking ID. Coordinated disclosure timelines start from your first message.

We publish what we patch

Every advisory ships with a CVE, a hash-anchored before/after, and credit unless you ask us not to.

We never silently ship

All security fixes are signed by three independent roles and appear in the public changelog — same day.

INDEPENDENT AUDIT PROGRAM

Five independent reviewers. Each one chosen because they will say no.

We do not pay for findings. We pay for review. If any of these labs come back with a critical finding, we patch it and publish it before public launch.

Citizen Lab (University of Toronto)Scoped

Targeted-surveillance independent review

Amnesty Tech Security LabScoped

Forensic review for human-rights defender workflows

Electronic Frontier FoundationScoped

Independent code and threat model review

Open Crypto Audit ProjectPlanned

Cryptographic implementation audit

Trail of BitsPlanned

Source-level security review (kernel + sovereign engines)

CERTIFICATIONS

Regulatory certifications, plainly tracked.

Common Criteria EAL5+In preparation

BSI / ANSSI

FIPS 140-3 Level 3In preparation

NIST CMVP

FCC Part 15Per-device

USA radio compliance

CE / REDPer-device

EU radio + product safety

GDPR processing recordPublished

EU data processing

ISO/IEC 27001 alignmentActive

Information security baseline

BUG BOUNTY

The numbers are real. Read the rules first.

We pay the listed amount for a working, reproducible exploit reported under coordinated disclosure. Lower tiers exist for partial findings. The fund is independently escrowed.

Persistent rootkit at boot
US$ 1,000,000
Kernel privilege escalation
US$ 250,000
On-device key extraction
US$ 500,000
Verified boot bypass
US$ 300,000
Side-channel key recovery
US$ 400,000
False emergency-alert injection
US$ 200,000
Sovereign tunnel break
US$ 300,000
Unauthorized device pairing
US$ 150,000
Forged device attestation
US$ 250,000

ADVISORIES

Every advisory we have published.

We publish on the same day we patch — even when the finding is uncomfortable.

No advisories have been published yet — the product is in closed beta. When the first one lands, it will appear here, in the changelog, and as a signed entry in the on-device audit ledger.

RESPONSIBLE DISCLOSURE

Report something to us.

Encrypted email with our PGP key, or via a HackerOne-style portal we are about to open. We acknowledge within 72 hours, coordinate timing with you, credit you, and pay if it qualifies.

security.txt

LEGAL SAFE HARBOR

We will not pursue you.

Good-faith research — including reverse engineering, side-channel analysis, and emulator-based testing — is explicitly permitted. We will not invoke anti-abuse statutes or contract law against researchers acting under this policy.