Security
Report a problem, and how we verify installers
If you find a weakness in Seico, please tell us first and give us a chance to fix it.
DRAFT. This policy is a draft. The contact address and the legal wording must be confirmed before launch.
Report a vulnerability
Email [TO CONFIRM: security@ address] with what you found, how to reproduce it, and how to reach you. A machine-readable contact is at /.well-known/security.txt.
Our disclosure policy
- Report privately first. Please do not publish details until we have had a reasonable time to fix the problem: [TO CONFIRM: response and fix timeframes].
- Test only against systems you own or are authorised to test. Do not access, change or keep other people's data, and do not disrupt services.
- We will acknowledge your report, keep you updated, and credit you if you wish.
- Good-faith research: [TO CONFIRM: safe-harbour wording, to be set by a lawyer].
How installers are verified
Each release comes with a checksum list. The install steps in your account check the installer against it before it runs, and tell you how to check it yourself. Releases are built the same way every time from the same source, so the same source gives the same file. A signed-release process is planned: [TO CONFIRM: signing method and where the public key is published]. During the pilot, installers are sent to pilot users directly, not through a public link.
What Seico does to protect itself
- The helper on your server runs under its own limited account, with no administrator rights.
- Each server has its own access key, which you can replace or revoke at any time. Keys are stored only in hashed form on our side.
- Each business sees only its own data.
- Text that attackers choose, such as user names, is treated as plain text everywhere, including before it reaches any AI notes.
