Security & responsible disclosure

The strongest control in EyeSay is architectural: the most sensitive data — a communicator's own messages, their Show Me photos, any microphone input — is designed never to leave the device, so there is no server-side store of it to breach. What we do hold is adult-created configuration, and we protect it with conventional controls.

• Encryption in transit. All traffic is served over HTTPS/TLS. Data at rest with our managed database and hosting providers is encrypted using their platform encryption.
• Authentication. Console access requires an authenticated adult account. There is no anonymous sign-up.
• Row-level authorisation. Database access is constrained by row-level security policies, so a signed-in account can only read or write rows belonging to the profiles and teams it is entitled to. Authorisation is enforced in the database, not only in the interface.
• Least privilege. Privileged server-side credentials are never exposed to the browser, are read only inside server-side handlers, and are used only for operations that genuinely require them.
• Separation of surfaces. The public website is a separate origin and holds no database credentials capable of reading profile, vocabulary or team data.
• Audit and versioning. Configuration changes, including promotion of a word to a permanent slot, are version-recorded so a change can be traced.
• Dependency hygiene. Dependencies are kept current and security advisories are reviewed and patched.
• Automated invariant tests. Our build asserts the safety-critical product rules — stable motor slot identity, presence of the agency words, and the rule that nothing is spoken without an explicit selection — so a regression fails the build rather than shipping.

• no raw message transcripts in analytics or in adult-facing views by default;
• no microphone audio retention;
• no continuous location history;
• no automatic upload of local camera images;
• no advertising or behavioural tracking code anywhere in the product or website.

eyesayaac.com is a static-rendered marketing and legal site. It has no account system, no database client and no authenticated data access. The only browser storage it uses is your own cookie preference and appearance choice, inventoried in the cookie notice.

Use a strong, unique password for your EyeSay account and keep it private. Lock the communicator's device with a passcode, since local-first storage means the device is where the sensitive content lives. Review who you have invited to a profile, and remove team members who no longer need access.

If you believe you have found a vulnerability, please tell us before telling anyone else. Email contact@prodiasystems.com with the subject line "Security" — a dedicated security address will be published when it is configured. Include what you found, how to reproduce it, and the impact you think it has.

We aim to acknowledge a report within 5 working days, give you an assessment within 15 working days, and keep you informed until it is resolved. We will credit you if you want that and the report is valid.

In scope: eyesayaac.com and console.eyesayaac.com. Out of scope: our third-party providers' own infrastructure (report those to the provider), social engineering of our staff, physical attacks, denial-of-service testing, and automated scanner output with no demonstrated impact.

If you research in good faith, stay within scope, avoid privacy violations and service degradation, do not access, modify or retain data that is not your own, and give us reasonable time to fix the issue before publishing, we will treat your research as authorised and will not pursue action against you.

If a personal data breach occurs and it is likely to present a risk, we will notify the Irish Data Protection Commission within 72 hours of becoming aware, as required by Article 33 GDPR, and we will inform affected people without undue delay where the risk to them is high. What we would tell you is set out in the privacy notice.