Aegixo handles sensitive information about students at the moments they are most vulnerable, so security is part of how we build it. This page describes what we do and how to report a problem.
1. How we protect Aegixo
- Encrypted connections. The apps, dashboards and website use HTTPS.
- Hashed passwords. Passwords are stored only as one-way hashes; we cannot read them.
- Campus separation. Security staff can only see their own institution's alerts and reports. We enforce it on the server and in the live-alert channels, and cover it with automated tests.
- Least-privilege staff roles. Pavictek dispatchers can handle alerts but cannot manage accounts, institutions or content. Only super admins can.
- Immediate cut-off. When a staff account is suspended, or a password is reset, existing sessions stop working straight away.
- Audit trail. Alert views, responses, account changes and sign-ins are recorded, and the log never stores passwords.
- Abuse protection. Sign-ins, registration and alerts are rate-limited, and repeated failed sign-ins are blocked.
- Safe retries. A repeated request, for example after a dropped connection, can never create a duplicate alert.
- Payments confirmed independently. We never activate a subscription from a payment notification alone; we check with Nomba first.
- Data minimisation. Location is tied to an alert or walk and deleted 30 days after it ends. Incident reports are anonymous to campus security.
No system is perfectly secure, and we keep improving. If you find a weakness, we want to hear about it.
2. Reporting a vulnerability
If you believe you have found a security issue in Aegixo, please tell us privately so we can fix it before it affects anyone.
- Email hello@aegixo.com with the subject "Security report".
- Describe the issue, where it is, and the steps to reproduce it. Screenshots or a short proof of concept help.
- Give us a reasonable time to fix it before you share it publicly.
In scope
- aegixo.com, app.aegixo.com and api.aegixo.com
- The Aegixo and Aegixo Responder mobile apps
Please do not
- Access, change or keep other people's data. Use only your own test accounts, and stop as soon as you have shown the issue.
- Run denial-of-service attacks, spam, or tests that could disrupt emergency alerts for real users.
- Use social engineering, phishing or physical attacks against our staff, partners or campuses.
- Test third-party services we rely on, such as Nomba, Google or OpenStreetMap.
What to expect
- We will acknowledge your report and keep you informed as we investigate.
- We will credit you if you would like, once the issue is fixed.
- We do not currently run a paid bug-bounty programme.
- If you follow these rules and act in good faith, we will not take legal action against you for your research.
Our machine-readable contact details are at /.well-known/security.txt.
3. Contact
Security questions that are not vulnerability reports: hello@aegixo.com.