OWL Product Security Information

How OWL protects your data, how to use and operate it securely, and how long it is supported. This page is provided as the user security information and instructions for the product, in line with the EU Cyber Resilience Act (CRA), Annex II.

In progress. NDEVR is finalizing this page as part of its CRA readiness ahead of the regulation's phased application (vulnerability-reporting obligations from 11 September 2026; full application 11 December 2027). Items marked In progress below will be completed before OWL is placed on the EU market. Release targets are identified explicitly; the reporting contact is live today.

Contents

  1. Manufacturer & contact
  2. How to report a vulnerability
  3. Intended purpose & security properties
  4. Security support period
  5. Secure use — instructions
  6. Reasonably foreseeable risks
  7. Software Bill of Materials (SBOM)
  8. Technical documentation

1. Manufacturer & contact

  • Manufacturer: NDEVR, LLC — 1300 W Morton St, Oakland City, IN 47660, USA · ndevr.org
  • EU authorized representative: In progress — to be appointed before OWL is placed on the EU market (required because NDEVR is established outside the EU).
  • Security / vulnerability contact: security@ndevr.org · /.well-known/security.txt

2. How to report a vulnerability

Report security issues to security@ndevr.org (PGP available). Our coordinated-disclosure policy, scope, and safe-harbor terms are at our disclosure policy. We acknowledge reports within 3 business days.

3. Intended purpose & security properties

OWL encrypts resource and chat payloads before upload. In client-side decryption (CSD), the provider stores ciphertext without a usable content key, including when recovery is enabled: your device wraps the recovery copy under a key only you hold. Server-side decryption (SSD) is an explicit provider-trust delivery mode. Private storage also encrypts file metadata and folder structure: names, types, descriptions, categories, exact original sizes, source timestamps and directory/version manifests. Account, authorization, billing and network records remain separate service data. See the privacy policy.

  • Content encryption: AES-256 on your device before upload. Authenticated AES-256-GCM formats verify a tag before accepting plaintext; current private files use authenticated segmented content encryption; older formats require migration. Do not infer universal content HMAC tags from the use of HMAC elsewhere. See cryptography.
  • Key wrapping: per-file and per-conversation keys are wrapped to your account's public key using ECIES (NIST P-256).
  • In transit: TLS/HTTPS with the platform's trusted roots.
  • Passwords: the web sign-in flow supports OPAQUE; private-key envelopes are encrypted locally under password-derived keys. Authentication and content decryption are separate layers.
  • Updates: software updates are digitally signed and verified before installation.

Important user responsibility. Your password protects a randomly generated account private key. Recovery wraps that same key on your device under a recovery key only you hold. If you lose the password, recovery key and all usable signed-in access, NDEVR cannot restore the account key. Keep the recovery key somewhere private and independent of the account.

4. Security support period

NDEVR provides free security updates and vulnerability handling during the product's security support period: at least 5 years from the date OWL is placed on the EU market. The exact end date will be published here once set (In progress). After that date, security updates are no longer guaranteed.

5. Secure use — instructions

  • Secure by default: OWL enforces transport security (TLS) and does not permit anonymous access. (Self-hosting operators: keep your TLS certificates valid and current.)
  • Strong credentials: use a strong, unique password and treat it as the key to your data (see security properties above).
  • Install updates promptly: OWL verifies update authenticity with a digital signature; apply security updates as they are released. (In-product security-update notifications: In progress.)
  • Recovery: save your recovery key somewhere safe and private; it is shown once and NDEVR cannot regenerate it. An emailed reset code authorizes retrieval of the encrypted envelope but cannot decrypt it.
  • Choose the delivery boundary: use CSD when the provider must not receive a usable content key; SSD sends the key and plaintext through the server for the requested delivery.
  • Reset to a secure initial state: guidance for resetting an account or installation to its original secure state is In progress.
  • Decommissioning / secure deletion: delete individual items or close your account to remove your data; secure account deletion with crypto-erase is In progress. Until then, request deletion via security@ndevr.org.
  • Data export / portability: you can download your files and data through the OWL clients at any time; expanded export tooling is In progress.

6. Reasonably foreseeable risks

  • Self-hosting the OWL server makes you responsible for maintaining TLS and applying updates promptly.
  • SSD exposes a usable key and plaintext to the server during the requested delivery. Use CSD when the provider must not have that access.
  • OWL Connect and the QUAIL AI assistant grant consented, scoped server-side access to specific data when you use them; enable them only for integrations you trust. See the privacy policy for what is processed.

7. Software Bill of Materials (SBOM)

OWL's third-party components are documented in a CycloneDX SBOM, available on request via security@ndevr.org.

8. Technical documentation

OWL's full technical documentation is available to EU market-surveillance authorities, on request, via the manufacturer or the authorized representative.