Trust · Security
How we secure your code
Your source code is yours. Here is exactly how we handle it, what we have and have not certified, and how to reach us.
How we handle your code
Follow a codebase from submission to deletion. Select a step, or watch it play.
You send code for an analysis you requested. Submitting does not transfer ownership or any license beyond what is strictly necessary to run it.
Assurance status, stated plainly
Vorthix is a new company. We would rather tell you now than have you find out later.
TLS in transit
All movement of code and findings.
Encryption at rest
Stored code and analysis data.
Access limited to engagements
No manual browsing outside an active scope.
SOC 2
We are building our practices toward it as we grow.
ISO 27001
We are building our practices toward it as we grow.
Paid bug bounty
We do not currently operate a paid bug bounty program.
Findings stay confidential
Any vulnerability XOR-1 identifies in your systems is treated as confidential client data.
No third-party sharing
Not shared with anyone without your explicit written consent.
Never published
Not disclosed or referenced publicly, including as a case study or in marketing, without your prior written approval of the specific content.
Need-to-know only
Internal access is limited to the personnel directly involved in delivering your engagement.
Built to avoid false findings
A finding is reported only when it traces to real, checkable evidence in your code, not a confident guess.
# XOR-1 finding review (illustrative, not real client data) finding F-0042 trace src/parser/decode.c:118 -> src/parser/decode.c:412 evidence checkable in your code status REPORTED
# XOR-1 finding review (illustrative, not real client data) finding F-0043 trace incomplete: path not confirmed evidence insufficient to confirm either way status INCONCLUSIVE note not forced into a false positive, not marked “all clear”
We would rather say “we couldn’t confirm this one way or another” than hand you a polished report built on a guess. Read the full evidence standard or how XOR-1 works.
Found a flaw in Vorthix itself?
This is about our platform and infrastructure, not a finding about your code. We want to hear first.
Please include
A clear description of the issue, steps to reproduce it, and its potential impact.
Please do not
- Disclose publicly before we can respond.
- Access or modify data that is not yours.
- Disrupt service for other users.
What to expect
Acknowledgment within 2, regular updates, and credit if you want it once the issue is resolved, in line with standard responsible disclosure practice.
To: security@vorthix.com Subject: [Security] short title of the issue Description: what the issue is Reproduce: step-by-step Impact: what could go wrong
We do not currently operate a paid bug bounty program.
Infrastructure & subprocessors
We may use trusted third-party infrastructure providers, such as cloud hosting or computing, to operate the service.
Email security@vorthix.com for the current list of subprocessors that may handle client data.
Any other question?
security@vorthix.com
For general questions, contact us or write to contact@vorthix.com.
This page describes our practices and policies. It is not a warranty or a guarantee of absolute security. No system is completely immune to risk, and we will always say plainly where our current limitations are.