Security

1. Our approach

Chrovia treats authorization integrity, transport protection, and product isolation as core product requirements.

Our model combines:

• signed authorization documents;
• fail-closed entitlement checks;
• least-privilege product surfaces;
• controlled distribution of desktop software and updates.

Deleting, withholding, or tampering with a license is designed not to unlock gated features. Missing or invalid authorization leaves protected capabilities disabled.

2. License and configuration integrity

Chrovia Licenses are signed with server-held keys and verified in the browser with embedded public keys.

Extended Preferences can carry a signed internal section for issuer-controlled configuration such as fingerprint and related settings. Ordinary end-user edits to signed fields without re-issuance are expected to fail validation.

Client secrets used for browser-to-Console authentication are intended for the browser runtime. Ordinary page or extension JavaScript should not be able to read them through product APIs.

3. Transport, accounts, and distribution

• Console and related APIs are served over HTTPS.
• Account sessions use modern authentication controls appropriate to the deployment.
• Update feeds and download artifacts are distributed through controlled object-storage paths.
• Version metadata can be published beside installers so clients display trustworthy version information.

4. Product isolation

Persona Hub profiles and Merca stores are designed as isolated browser instances with separate state. Kernel features that affect fingerprint, proxy, credentials, messaging, network behavior, or process control are entitlement-gated and configuration-driven.

Provision Extensions implement privileged always-on product behavior. Public web origins do not receive the same privileged API surface by default.

Local users still control the machine. Security controls raise the cost of casual misuse and remote forgery; they are not a substitute for endpoint security on devices you manage.

5. What we do and do not claim

We design for defense in depth around authorization and product boundaries.

We do not claim that fingerprint or automation features make activity undetectable, that any local secret is impossible to extract from a fully compromised machine, or that third-party bot-defense systems can never change.

Where we have not published independent certifications, we do not represent that Chrovia holds specific third-party audit marks. Security claims on this page describe product design and operational practice.

6. Vulnerability reporting

If you believe you have found a security vulnerability in a Chrovia product or service, email support@getchrovia.com with:

• a clear description of the issue;
• affected product and version;
• impact assessment;
• reliable reproduction steps or proof-of-concept details sufficient for verification.

Please:

• give us a reasonable opportunity to investigate and remediate before public disclosure;
• do not access data that is not yours;
• do not degrade service availability while testing;
• do not use social engineering against support staff or individual users as part of testing without prior written approval.

7. Our response

We review valid reports, prioritize by severity and exploitability, and work to ship fixes or mitigations. We may contact reporters for clarification. When requested and appropriate, we can credit coordinated disclosure.

We do not offer a public bug-bounty payment program on this page unless separately announced.

8. Out-of-scope examples

The following are generally out of scope as product vulnerabilities unless they demonstrate a clear bypass of our authorization or isolation model:

• issues requiring physical access to an unlocked machine already under attacker control;
• extraction of secrets after full local compromise of the endpoint;
• pure denial-of-service volume testing without prior approval;
• spam or social engineering against users or support inboxes;
• findings that depend solely on defeating future third-party bot-detection heuristics;
• vulnerabilities in third-party destination sites or proxies not operated by Chrovia.

9. User responsibilities

You should:

• use strong unique passwords and protect account recovery channels;
• keep desktop products and operating systems updated;
• protect license files, client secrets, and profile directories on disk;
• grant team access carefully;
• report suspected account takeover or license abuse promptly.

10. Contact

Security reports and questions: support@getchrovia.com.

Related documents: Privacy Policy, Terms of Service, Software License.