Security and vulnerability reporting

This is a translation. The Vietnamese text at /phap-ly/bao-mat prevails, except where the law requires the version more favourable to a consumer.

This document describes the security measures XNK24 applies to the xnk24.com website and the XNK24 Pro application, your own responsibilities, and how to report a security vulnerability. How XNK24 handles personal data is described in the Privacy policy and personal data processing notice.

Version 1.1, effective from 28/10/2026.

Chapter I. Security measures

Article 1. Principle: customer data does not go online

The strongest security measure of XNK24 Pro is its design: your documents, customs declarations, HS codes and counterparty information are processed by the AI assistant on your own machine and are not sent to XNK24. Because XNK24 does not hold this data, XNK24 servers cannot leak it.

Article 2. In the XNK24 Pro application

1. The application's user interface has no Internet access. All network connections are made by the application core, and only to fixed, predefined addresses.
2. The AI assistant runs offline and has no web search tool.
3. Application updates, data packs and licences are all digitally signed. The application verifies the signature and rejects anything that does not match.
4. Your machine is identified by a salted hash; the original machine identifier never leaves the machine.
5. The sign-in token is kept in the application core and is not exposed to the user interface layer.
6. Crash reports, usage statistics and performance measurements are sent only if you turn them on, and you can preview exactly what will be sent.

Article 3. On XNK24 servers

1. All connections to xnk24.com use HTTPS (TLS 1.2 or later) and go straight to the server in Vietnam.
2. Application services are not exposed directly to the Internet; the firewall blocks all inbound connections by default. Server administration is only through SSH with keys, not passwords; the database administration page is not reachable from the Internet.
3. Account passwords are stored only as hashes. Member email addresses do not appear in publicly returned data.
4. Sensitive operational data, such as integrity signals, is accessible only with the server's service key.
5. A payment notification from SePay is recorded only if it carries a valid signature. Logs do not record transfer content.
6. Downloads of the AI model are rate-limited; new members of Hỏi đáp (Q&A community) have a daily post limit.
7. The account database is backed up daily.
8. Only personnel assigned to the task may access the servers and personal data.

Article 4. Protecting data on your machine: each party's part

1. XNK24's part: keeping the XNK24 Pro software secure as described in Article 2, fixing vulnerabilities under Chapter II, digitally signing every update, and not sending your documents off your machine.
2. What you need to know: data in XNK24 Pro is not separately encrypted by the application. Conversations, documents read, quotations, declaration worksheets and the Notebook (Sổ tay) are stored in ordinary database files on your machine. Anyone who can open the machine's disk can read these files.
3. Your part: the computer, the operating-system account and the people allowed to use the machine are under your or your organisation's control, so the following protective steps are for you to take. We recommend:
   1. turn on full-disk encryption: FileVault on macOS, BitLocker or Device Encryption on Windows;
   2. set a sign-in password for the machine, lock the screen when you step away, and do not share a computer account;
   3. keep the operating system and XNK24 Pro up to date; download XNK24 Pro only from xnk24.com;
   4. use a separate XNK24 password and do not reuse it on other services; do not share your account;
   5. when selling, lending or disposing of the machine, use Settings → Data → "Delete all data…" and then wipe the disk following your operating system's instructions;
   6. do not send documents or customer data through Support or Hỏi đáp.
4. If you see signs that someone else is using your account (for example, the application reports that your account is active on a machine you do not use), change your password and notify cto@xnk24.com immediately.

Chapter II. Reporting security vulnerabilities

Article 5. Scope

1. In scope:
   1. the xnk24.com website and its API paths (/api, /pb);
   2. the latest version of the XNK24 Pro application downloaded from xnk24.com, on Windows and macOS;
   3. files downloaded from xnk24.com: installers, data packs, AI models.
2. Priority is given to flaws that could expose, alter or delete other members' data; take over accounts; execute code remotely; bypass signature checks on updates or data packs; or cause data on a user's machine to be sent out.
3. Out of scope:
   1. the systems of Cloudflare, SePay, VietQR, banks, email providers and third-party websites;
   2. denial-of-service attacks, spam, social-media phishing or physical access;
   3. automated scan results without a way to reproduce them, or missing security headers with no practical impact;
   4. issues that can be exploited only when the attacker already controls the victim's machine.
4. Ways to bypass the licence, skip payment or modify the application to use paid features: you may report them under this Policy, but you must not use, share or publish them. Reverse engineering the application beyond what is necessary to confirm a vulnerability is not within the permitted scope (Terms of use).

Article 6. How to report

1. Send an email to cto@xnk24.com with a subject beginning "[Security]" (Vietnamese: "[Bảo mật]"). This contact information is also available at /.well-known/security.txt.
2. Describe: where the flaw is (path, application version, operating system), the steps to reproduce it, the impact you observed, and how to contact you. Screenshots or sample code help us respond faster.
3. Do not attach personal data of other people that you have seen. Describe only the type and quantity of the data.

Article 7. When researching, please

1. use only your own account, or a test account you create yourself;
2. stop as soon as you have demonstrated the vulnerability; do not access, download, alter or delete other people's data beyond the minimum needed to demonstrate it;
3. not disrupt the Service, not run tools that generate heavy load, and not install backdoors or retain access;
4. not disclose the vulnerability before XNK24 has fixed it, or before 90 days from your report if the parties have not agreed another date;
5. not demand money or conditions in exchange for not disclosing;
6. comply with the law of Vietnam.

Article 8. XNK24's commitments to reporters

1. Response times: acknowledge receipt within 02 working days; give an initial assessment and severity rating within 07 working days; update you on progress at least every 14 days until the fix is complete.
2. Fixes: serious flaws are fixed ahead of all other work; we will tell you when the fix is released.
3. Recognition: if you wish, we will name you in the acknowledgements when we publish the fix.
4. No pursuit: if you research in good faith and comply with Article 5 and Article 7, XNK24 treats that activity as authorised under this Policy, will not sue or request that action be taken against you for it, and will not lock your account for it. If a third party brings a claim over activity that complies with this Policy, we will state that you acted in accordance with the Policy.
5. XNK24 currently has no programme paying monetary rewards for vulnerability reports.

Chapter III. Incident handling

Article 9. When a security incident occurs

1. When a security incident occurs, XNK24 takes these steps: detect and record; contain (for example revoke keys, block access, suspend the affected service); assess the data and users affected; remediate; draw up a record; review lessons learned.
2. Notifications:
   1. the competent state management authority within 24 hours of discovering that a system holding customer information has been attacked (Law on Protection of Consumers' Rights (Luật Bảo vệ quyền lợi người tiêu dùng) 2023);
   2. the specialised personal data protection agency under the Ministry of Public Security no later than 72 hours after discovering a personal data breach (Law on Personal Data Protection (Luật Bảo vệ dữ liệu cá nhân) 2025);
   3. the specialised cybersecurity force as required by the Law on Cybersecurity (Luật An ninh mạng);
   4. affected members, by email and in the application, as soon as determined, with guidance on what you should do.
3. When the Service must be suspended to deal with an emergency incident, we will notify you on xnk24.com and in the application as soon as we can. Planned maintenance is announced in advance under the Terms of use.

Article 10. Contact

• Reporting vulnerabilities and security incidents: cto@xnk24.com
• Telephone: 0941 221 183
• CÔNG TY TNHH GIẢI PHÁP VIETFLOW (VIETFLOW SOLUTION COMPANY LIMITED), 6th Floor, Viet A Building, 9 Duy Tan Street, Cau Giay Ward, Hanoi City, Vietnam