Security model and boundary
The website manages email identity, billing state, license points, and Desktop/Browser slots. Desktop Projects and ordinary Browser content are not placed in the website database merely because a user signs in or validates a license.
Future model, sync, or tool connections still require Project boundaries, capability-level permission, and user confirmation, plus a separate security and privacy review before release.
A license proves that a device currently has a specific entitlement. It does not grant the website every file, page, or system capability on that device.
Account and session protection
Email verification
New accounts verify email. Reset links are time-limited, and a successful password reset revokes other sessions.
Password credentials
Password lengths are constrained and credentials are stored as secure hashes; support does not need or display plaintext passwords.
Session control
Sessions last up to 30 days and refresh periodically. Necessary IP and User-Agent signals help identify and protect against abnormal activity.
Abuse controls
Identity endpoints use database-backed rate limits, trusted origins, and same-origin return-path checks.
Payment and subscription integrity
- Paddle Checkout handles payment methods and full card data; XAgent does not directly store card numbers or security codes.
- The server verifies Paddle webhook signatures and processes events idempotently to prevent replay from issuing duplicate licenses.
- Entitlement follows verified subscription and transaction state; failed, canceled, expired, or revoked payments affect later validation.
- Customer, transaction, and subscription records bind to an account identifier so matching email alone does not reassign a purchase to another account.
Activation Keys and device certificates
Key shown once
The cloud stores only the Activation Key hash and a trailing hint. A lost key must be rotated and cannot be recovered in plaintext.
Hashed device identity
Client UUIDs are hashed before storage. Desktop and Browser occupy independent device slots.
Signed certificates
Activation issues an ES256 device certificate. Renewal checks the certificate, device hash, binding ID, generation, and current paid state.
Revocable lifecycle
A new device replaces the old binding; Account can unbind a slot. Rotating a key invalidates the old key and both current bindings.
Traceable events
Activation, replacement, renewal, rejection, unbinding, and rotation record request ID, device type, app version, and time for review and diagnosis.
Server and operational controls
- Sensitive secrets are supplied through hosted environment variables, not browser bundles or public source.
- APIs validate fields, lengths, UUID shape, protocol version, and account ownership, and return only what is needed.
- Subscription, license, and device changes produce audit events. High-risk actions require an authenticated account or valid device certificate.
- We rely on hosting, Paddle, and Resend controls while limiting each provider to the data needed for delivery.
This page is not a claim of ISO 27001, SOC 2, PCI DSS, or another independent certification unless a certification is explicitly published later.
Security steps for users
- Use a unique, long password and protect the email account that can reset it.
- Never post an Activation Key in chat, tickets, or screenshots. Enter it only in a trusted official XAgent client.
- Download installers from Download Center and verify publisher, signature, and integrity information. Do not install modified builds from unknown sources.
- If a device is lost, a key leaks, or a binding is unfamiliar, unbind the device and rotate the key in Account immediately.
Disclosure process
Describe the affected surface, repeatable steps, expected and actual behavior, likely impact, and a proposed fix if available. We will validate the report, assess severity, and coordinate remediation and disclosure.
Test only accounts and data you own or are authorized to use. Avoid social engineering, denial of service, persistence, downloading other users' data, or disrupting production. There is currently no bounty program or safe-harbor promise for testing outside a separate written agreement.
Limits, incidents, and updates
No internet transmission, software, or storage system is absolutely secure. We improve controls according to risk and do not claim that breaches are impossible.
If a confirmed incident affects users, we will contain it, remediate it, preserve evidence, and notify affected users or authorities within the scope and time required by applicable law. Material control or disclosure changes update the date above.
Report vulnerabilities responsibly
Include the affected URL or version, reproduction steps, impact, and any necessary screenshots. Do not include real passwords, Activation Keys, payment data, or another user's information, and do not disrupt service or access another account to prove impact.