Security and trust center
As a company that helps others secure their products, this is how we protect our own systems and how to reach us when you find a vulnerability.
Security contact
If you found a vulnerability in our products, platform or website, write to this address directly. We respond within 48 hours at the latest.
contact@tegmensoft.com.trData in transit
All traffic to our site and platform is encrypted with TLS. Devices connect over HTTPS with server certificate validation, and every device request is signed with that device's own ECDSA P-256 key, with a nonce and timestamp against replay.
Tenant isolation
On the platform every query is scoped to the customer's tenant, and PostgreSQL row-level security enforces the same boundary in the database. Stored files are encrypted.
On the device
Update manifests are signed with ECDSA P-256 using a key per customer. Before installing, the device checks the signature, the image hash and the anti-rollback protection; the update is written to the inactive A/B slot.
SBOM scanner
In the web SBOM scanner your files are read in your browser and not sent to our servers. For the vulnerability check only package name, version and ecosystem are queried on OSV.dev.
Website
We use no advertising or tracking tools. Our visitor measurement is cookieless (Amazon Web Services, data centre in Germany) and does not recognise anyone across visits.