1Security controls
The company Terminal checks permissions on the server. Account passwords are stored as password hashes, and sign-in tokens use HttpOnly cookies. Sensitive vault material is encrypted; privileged operations are recorded in an audit trail. Additional verification protects designated sensitive operations.
XOS1 authenticates its install to the company gateway so provider API keys can stay on the server rather than being distributed with customer releases. These controls reduce risk; they do not make the software invulnerable or establish an independent certification.
2Your device and account
Local XOS1 information depends on the security of your computer and its user account. Use a strong device password, current security updates and disk encryption where appropriate. Keep backups and do not share account credentials or install access tokens.
Only grant permissions you understand. A person with access to your local files or an unlocked account may be able to read or change local information. Local storage does not by itself mean that information is encrypted.
3Report a vulnerability
Email [email protected] with the affected product or page, the version, reproduction steps and the potential impact. Use a minimal, redacted example. Do not send secrets or other customers’ personal information.
Do not exploit the issue beyond what is necessary to report it, access another person’s account or data, disrupt services, or conduct testing without authorisation. Contact us before any testing that could affect a live system. This notice does not offer a bug-bounty payment or grant testing permission.
4Protecting parental access
The planned parental-control feature requires verified guardian authority, authenticated access and checks that limit visibility to the authorised child and disclosed activity. Those controls must be tested before release; this notice does not claim a parental dashboard is already available.
Changes of age must update the applicable access configuration without granting administrative rights or expanding device permissions. Ending under-13 parental activity visibility must revoke that access, rather than merely hide a screen. Report unintended access to [email protected] using a redacted example.
5Incidents and limitations
No software or security measure can eliminate every risk. If a personal-data breach triggers a legal notification requirement, we will notify the relevant authorities and affected individuals as required by applicable law. We do not claim that a policy page can prevent an incident.