Threat Modeling & Coordinated Disclosure

Security, Threat Model & Vulnerability Reporting

VECTAC's engineering model is fail-closed. We enforce hardware-backed silicon key lifecycles on mobile clients, ephemeral pairing channels for proctors, and a transparent vulnerability disclosure process.

Hardware-Backed Silicon Encryption

At-Rest & In-Transit Isolation

Device-Only Enclave Keys:
iOS Keychain complete file protection (`NSFileProtectionComplete`) and Android Keystore AES-GCM. Keys never leave physical hardware.
Ephemeral Proctor Channels:
Single-use pairing nonces with 10-minute expiry windows. Forward-secret session keys are destroyed permanently upon session close.
Tenant Data Isolation:
Strict logical database isolation per organization tenant. Support elevation is reason-coded, time-bounded, and cannot view private fitness files.

Coordinated Disclosure Program

security@vectac.io · PGP Key Available

If you identify a security defect in VECTAC mobile clients, proctor pairing relays, or web administrative services, submit a report to our security engineering team.

Initial Triage SLA:≤ 24 Hours

Assessment & Patch Target:≤ 72 Hours

Safe Harbor Policy:Enforced for Good-Faith Research

Submit Security Report (security@vectac.io)

Build Evidence Note: Independent commissioned penetration test status is actively tracked in the release appendix.

View Build Appendix →