Security

Reporting a vulnerability

If you find a vulnerability in a CAPTiX product or service, email security@captix.eu. Our contact details are also published in security.txt (RFC 9116). We accept reports in Polish, English and French.

Reports cover the components CAPTiX supplies or operates: the CAPTiX XR client application for Meta Quest headsets, the platform backend and API, the database and authentication, and the third-party libraries used in them.

Please include in your report:

• a description of the vulnerability and its possible impact,
• the affected component and its version,
• steps to reproduce the issue and, where possible, a proof of concept,
• your contact details and whether you would like to be named in the acknowledgments on this page.

Our response times:

• acknowledgement of receipt: 2 business days,
• initial assessment and classification: 10 business days,
• notice of remediation: promptly after the fix is deployed.

Coordinated disclosure policy

CAPTiX practises coordinated vulnerability disclosure: it will not pursue legal action against good-faith researchers who did not access customer data, did not disrupt the service, and withheld publication until a fix was released or 90 days had passed.

When testing, please stay within these limits:

• no denial-of-service attacks or any other activity that disrupts the availability of the service,
• no access to customer data — if you come across such data, stop testing and report it to us,
• no social engineering of CAPTiX employees.

Remediation timelines

Vulnerabilities are classified using CVSS v3.1. The clock starts on the day a fix becomes available (upstream patch release) or on confirmation of the report where the vulnerability is in CAPTiX's own code.

• Critical (CVSS 9.0–10.0): fixed within 30 days; customers notified immediately, no later than 72 h after confirmation.
• High (CVSS 7.0–8.9): fixed within 90 days; customers notified in the next advisory, no later than 30 days.
• Medium (CVSS 4.0–6.9): fixed within 180 days; customers notified in the periodic advisory.
• Low (CVSS 0.1–3.9): fixed in the next scheduled release; details on request.

A vulnerability under active exploitation (public exploit or observed attack) is treated as Critical regardless of its CVSS score and handled out of sequence.

Backend and API patches are deployed continuously (CD) after automated tests pass. Each client application release is published to a separate Meta distribution channel; the customer's fleet administrator decides when the version reaches the devices. For a critical patch, we notify the customer and recommend a deployment date.

How we secure the platform

Encryption in transit: the CAPTiX XR headset application and the CAPTiX portal connect to the API and the database only over encrypted TLS (HTTPS) connections.

Encryption at rest (servers): the database in Supabase is encrypted at rest by the supplier.

Content stored on headsets: recordings and instructions stored in the headset's memory are not additionally encrypted by CAPTiX XR. The customer is responsible for physical access to the headsets and for the rules on connecting them to computers.

Software bill of materials (SBOM): we generate an SBOM in CycloneDX format for every production release. It is provided to customers on request under a non-disclosure agreement.

Infrastructure and suppliers

Customer and user data is stored exclusively in the European Union. Below are the suppliers processing data as part of the service, together with the independent certifications we have verified. As of 27 September 2026.

• Scalingo SAS — application and API hosting (PaaS). Processing location: Paris, France (region osc-fr1, 3DS Outscale infrastructure). Certifications: NF EN ISO/IEC 27001:2022, certificate no. 38435 issued by BYCYB, valid until 11 September 2028; HDS 2.0, certificate no. 38436, BYCYB.
• 3DS Outscale — infrastructure layer and physical datacenter (Scalingo sub-processor). Processing location: Paris, France. SecNumCloud 3.2 qualification granted by ANSSI, as well as ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, HDS and SOC 2 Type II.
• Supabase Inc. — database and authentication. Processing location: European Union, region eu-central-1 (Frankfurt, Germany). Certifications: SOC 2 Type II and ISO/IEC 27001. The report and certificate are provided to customers on request, to the extent permitted by the supplier.
• Cloudflare, Inc. — bot protection for the portal's sign-in and sign-up forms (Cloudflare Turnstile). Processes portal users' IP addresses and browser signals on Cloudflare's global network, including outside the European Economic Area.
• Meta Platforms Technologies Ireland Limited — headsets and the application distribution channel. Meta does not process the content of CAPTiX instructions.

Recordings and instructions never leave the customer's headsets: the application sends the platform only the data needed to activate and verify its licence. The current sub-processor list is an annex to the data processing agreement and is updated whenever it changes.