1. Purpose and standards
ONMAKE manages xMath security through risk-appropriate measures and the duties in documents 01 and 06. This policy is not certification, a vulnerability-free guarantee or an unagreed availability promise. Versions, configurations and dependencies must remain identifiable to distinguish BETA from production.
2. Updates and end of support
Updates necessary for conformity, including security updates, are provided for the legally required period. Web-service updates may arrive when the app loads; users may be asked to reload after saving work. Where user action is required, ONMAKE supplies instructions and explains the consequences of not taking it.
Changes not necessary for conformity follow article 10 of document 01. Version retirement is communicated with reasonable notice and migration/export options and does not extinguish accrued rights. Urgent work may require narrow suspensions, explained as soon as security permits.
3. Reporting an issue
Vulnerabilities may be reported to info@onmake.it with subject "xMath Security". Include version, environment, affected path, description, minimal reproduction steps on your own data and likely impact. Do not send unnecessary passwords, tokens, keys, third-party data or confidential files; request an agreed channel first for sensitive details.
ONMAKE assesses priority, exploitability and impact, contains risk and arranges remediation. Financial rewards, absolute repair deadlines and automatic report approval are not promised. Statutory duties to inform users, customers and authorities within applicable times remain unaffected.
4. Responsible research
Research must use owned or expressly authorised accounts and data, minimise access and stop when others' data is exposed. Social engineering, exfiltration, persistence, destructive attacks, denial of service and modifications to others' data are not authorised. Coordinate disclosure of details that materially increase risk without waiving legitimate authority reporting. This policy does not generally authorise otherwise unlawful activity.
5. Incidents and regulatory compliance
Personal data breaches follow the GDPR and DPA, including prompt Customer notice and the agreed initial-notification deadline. Cyber Resilience Act duties are assessed for components and delivery modes actually within its scope: classification does not follow merely from being a web app. Where applicable, ONMAKE also implements reporting processes under provisions already in force; no unachieved conformity certification or marking is claimed.
6. User cooperation
Use supported updated browsers, protected credentials, personal profiles on shared devices and independent copies of important documents. Promptly report suspicious access and preserve necessary technical information without disclosing others' data. These precautions do not relieve ONMAKE of its safeguards or defect remedies.