Last updated: 12 October 2026
To report a vulnerability, email privacy@avcpp.com with “Security report” in the subject. Machine-readable contact details are in /.well-known/security.txt.
What to send
- The page, feature or address affected, and what an attacker could do.
- The steps to reproduce it, with any proof-of-concept code.
- How we can reach you, and whether you would like to be credited.
Please do not include customer data in a report. If you came across any, tell us what it was without copying it.
What we commit to
- We confirm that we received your report within 3 business days.
- We tell you within 10 business days whether we reproduced it and what we plan to do.
- We keep you informed until it is fixed, and we credit you once it is, if you wish.
- We aim to fix critical issues within 7 days and high-severity issues within 30 days.
Good-faith research
We will not take legal action against, or ask a provider to act against, anyone who researches and reports in good faith under this policy. Good faith means that you:
- test only against your own account or a workspace you are allowed to use;
- stop as soon as you reach data that is not yours, and do not keep, copy or share it;
- do not degrade the service for others: no denial-of-service, spam, or automated scanning at a volume that affects other customers;
- do not use social engineering, phishing, or physical attacks against our staff, customers or providers;
- give us a reasonable time to fix an issue before you disclose it, normally 90 days.
If you are unsure whether something is allowed, ask us first at the address above.
In scope
- The NX6 OS application at nx6.ai and orbital-valor-498514-b2.web.app, and its public link pages (shared reports, approvals, photo drops).
- The NX6 OS Cloud Functions those pages call.
Out of scope: the services we connect to on your behalf (Google, Meta, LinkedIn, Stripe and others) — report those to the provider; findings that need a rooted or compromised device; missing best-practice headers with no demonstrated impact; and reports produced only by an automated scanner.
How we protect customer data
- Every connection to NX6 OS uses TLS; data at rest is encrypted by Google Cloud, and the access and refresh tokens of connected accounts are additionally encrypted with a key kept in Google Secret Manager.
- Each workspace is isolated by server-side access rules covered by automated tests; a person reaches only the workspace, clients and locations they were given.
- Sign-in is through Google or a one-time email link; NX6 OS stores no passwords.
- Server secrets live in Secret Manager and never reach the browser; a check before every commit refuses a hard-coded secret.
- Daily database backups and point-in-time recovery are switched on.
- See the Privacy Policy for what data we hold and why, and the Data Deletion Instructions to remove it.