Data boundary
The cloud handles identity, billing status, licenses, and Desktop/Browser device slots. Every cloud-bound data category and purpose is shown at the relevant product point and requires customer confirmation.
Signing in or checking a license does not by itself send local Project files, desktop content, browsing history, or ordinary page content to XAgent.
A device license proves access; it does not grant XAgent access to the device’s files, pages, or system capabilities.
Account and payment controls
- Passwords are stored as secure hashes; email verification, limited reset links, protected sessions, request validation, and rate limits help protect accounts.
- Paddle handles payment methods and full card details. XAgent verifies billing events and does not store full card numbers.
License controls
- Activation Keys and device identifiers are stored as hashes where applicable. Desktop and Browser have separate device slots.
- ES256-signed device certificates support activation, renewal, replacement, and revocation. Lifecycle events provide an account-visible history for review and troubleshooting.
Reporting and response
Report suspected vulnerabilities or account, payment, or licensing abuse to security@xagent-forge.com. We assess valid reports, limit impact, preserve necessary evidence, fix confirmed issues, and provide legally required notices.
No internet service can promise absolute security. We review these controls as the service changes.
Report a security issue
Include the affected URL or version, reproduction steps, and impact. Do not include real passwords, Activation Keys, payment data, or other users’ data, and do not disrupt the service or access accounts you do not own.