Last updated: 31 August 2026
1. Appliance protections
- Setup PIN — the first-run wizard and Settings are protected by a trust-on-first-use PIN with brute-force delays.
- Signed sessions — authenticated access is carried in signed, HTTP-only cookies and never stored in local storage.
- Signed updates — update bundles are cryptographically signature-verified before installation, backed up before the update is applied, health-checked afterwards, and automatically rolled back if the update fails.
- Encrypted backups — nightly archives are AES-256 encrypted with a unique backup passphrase generated for your installation.
- Secrets stay on device — API keys and integration credentials remain in the local appliance configuration and are masked in the user interface.
2. Your responsibilities
Keep your KEEPIQ appliance on a trusted network and install security and software updates when they are offered.
Choose a strong Setup PIN and backup passphrase and keep them secure.
Do not expose the appliance directly to the public internet. If you require remote access, use a properly configured VPN or another secure access layer providing appropriate encryption, authentication and access control.
3. Reporting a vulnerability
If you discover a potential security vulnerability in KEEPIQ, send a description of the issue, the affected version and reproduction steps to the security contact listed in the Impressum.
We aim to acknowledge security reports within 3 working days and to provide a fix or mitigation for confirmed vulnerabilities as quickly as their severity reasonably requires.
When conducting security research:
- test only systems and devices you own or have explicit permission to test;
- do not access, modify or exfiltrate other people’s data;
- avoid actions that could disrupt services or damage data; and
- give us reasonable time to investigate and address a confirmed vulnerability before public disclosure.
We will credit responsible reporters in the relevant release notes unless they prefer to remain anonymous.
4. Out of scope
The following are generally outside the scope of KEEPIQ vulnerability reporting:
- findings that require physical access to an already unlocked device;
- issues caused solely by deliberately disabling or bypassing documented security measures;
- self-inflicted network or appliance misconfiguration; and
- vulnerabilities or attacks affecting independent third-party services that you choose to connect to KEEPIQ.
If a third-party vulnerability reveals a separate security issue in KEEPIQ itself, the KEEPIQ-specific issue remains in scope.