OWL Product Security Information

How OWL protects your data, how to use and operate it securely, and how long it is supported. This page is provided as the user security information and instructions for the product, in line with the EU Cyber Resilience Act (CRA), Annex II.

In progress. NDEVR is finalizing this page as part of its CRA readiness ahead of the regulation's phased application (vulnerability-reporting obligations from 11 September 2026; full application 11 December 2027). Items marked In progress below will be completed before OWL is placed on the EU market. The security properties and reporting contact described here are live today.

Contents

  1. Manufacturer & contact
  2. How to report a vulnerability
  3. Intended purpose & security properties
  4. Security support period
  5. Secure use — instructions
  6. Reasonably foreseeable risks
  7. Software Bill of Materials (SBOM)
  8. Technical documentation

1. Manufacturer & contact

  • Manufacturer: NDEVR, LLC — 1300 W Morton St, Oakland City, IN 47660, USA · ndevr.org
  • EU authorized representative: In progress — to be appointed before OWL is placed on the EU market (required because NDEVR is established outside the EU).
  • Security / vulnerability contact: security@ndevr.org · /.well-known/security.txt

2. How to report a vulnerability

Report security issues to security@ndevr.org (PGP available). Our coordinated-disclosure policy, scope, and safe-harbor terms are at our disclosure policy. We acknowledge reports within 3 business days.

3. Intended purpose & security properties

OWL encrypts resource and chat payloads before upload. In client-side decryption (CSD) with provider-held recovery disabled, the provider stores ciphertext without a usable content key; server-side decryption (SSD) and optional account recovery are explicit provider-trust modes. Account, routing, sharing, and resource metadata remain visible, and public authored Sites are plaintext.

  • Content encryption: AES-256, performed on your device before upload, with HMAC-SHA-256 integrity tags. (Authenticated AES-256-GCM is used for key wrapping and escrow — see cryptography.)
  • Key wrapping: per-file and per-conversation keys are wrapped to your account's public key using ECIES (NIST P-256).
  • In transit: TLS/HTTPS, with pinned roots in the desktop and CLI clients.
  • Passwords: never transmitted; only a salted bcrypt hash of a password-derived credential is stored.
  • Updates: software updates are digitally signed and verified before installation.

Important user responsibility. Your encryption keys are derived from your password. If you lose your password and have not enabled the optional recovery (escrow) feature, your encrypted data cannot be recovered — by design. See also the privacy policy.

4. Security support period

NDEVR provides free security updates and vulnerability handling during the product's security support period: at least 5 years from the date OWL is placed on the EU market. The exact end date will be published here once set (In progress). After that date, security updates are no longer guaranteed.

5. Secure use — instructions

  • Secure by default: OWL enforces transport security (TLS) and does not permit anonymous access. (Self-hosting operators: keep your TLS certificates valid and current.)
  • Strong credentials: use a strong, unique password and treat it as the key to your data (see security properties above).
  • Install updates promptly: OWL verifies update authenticity with a digital signature; apply security updates as they are released. (In-product security-update notifications: In progress.)
  • Recovery, with eyes open: escrow lets the operator recover your account private key and, with stored wrapped keys, content available to that account. Enable it only if you accept that provider-trust trade-off.
  • Choose the delivery boundary: use CSD when the provider must not receive a usable content key; SSD sends the key and plaintext through the server for the requested delivery.
  • Reset to a secure initial state: guidance for resetting an account or installation to its original secure state is In progress.
  • Decommissioning / secure deletion: delete individual items or close your account to remove your data; secure account deletion with crypto-erase is In progress. Until then, request deletion via security@ndevr.org.
  • Data export / portability: you can download your files and data through the OWL clients at any time; expanded export tooling is In progress.

6. Reasonably foreseeable risks

  • Self-hosting the OWL server makes you responsible for maintaining TLS and applying updates promptly.
  • SSD exposes a usable key and plaintext to the server during delivery; optional recovery (escrow) lets the operator recover the account private key and account-wrapped content keys.
  • OWL Connect and the QUAIL AI assistant grant consented, scoped server-side access to specific data when you use them; enable them only for integrations you trust. See the privacy policy for what is processed.

7. Software Bill of Materials (SBOM)

OWL's third-party components are documented in a CycloneDX SBOM, available on request via security@ndevr.org.

8. Technical documentation

OWL's full technical documentation is available to EU market-surveillance authorities, on request, via the manufacturer or the authorized representative.