Security

ThreVox clusters sit on the CAN bus of working machines, and our cloud stores what they report. If you have found a vulnerability in either, we want to hear about it from you first.

Report a vulnerability

Email security@threvox.com. Please keep it private until we have agreed a disclosure date with you. Tell us what is affected (cluster firmware version, app, dashboard, API or service), what an attacker needs, and how to reproduce it. We read English and Spanish.

Test only against units, tenants and accounts you own or are authorised to test. Never touch another customer's data, never degrade the service for others, and never test on a machine in operation.

What we commit to

• An acknowledgement within 3 working days, and an assessment within 10.
• Updates until it is fixed, and a fix or mitigation before public disclosure. 90 days from the report is our default horizon; sooner when the fix ships sooner.
• Credit in the advisory if you want it, and no legal action against good-faith research that follows this policy.

Scope

Cluster firmware and its update paths (cloud and USB), the device link, the cloud services and APIs, the web dashboard, the layout builder, the mobile app and the sites under threvox.com. Denial of service by volume and social engineering are out of scope.

How fixes reach machines

Firmware and screen layouts are signed and verified on the cluster on every tier, including updates installed from a USB drive, so a fix reaches units that are never online the same way it reaches connected ones. We publish an advisory for every vulnerability that affected customers and notify authorities where the law requires it.

Machine-readable contact: /.well-known/security.txt.