A genuinely deployed product state
Core communication, device, cryptographic and operating workflows are deployed in production and bounded through the published release and evidence path.
VENTEX CONNECT / PRODUCT SECURITYPUBLIC CONTROL RECORD · 2026-09-09
Support boundaries are part of the product.
This page connects product state, the security-update path, support boundaries, vulnerability handling and regulatory preparation. It publishes only what is genuinely committed today—and what deliberately remains open.
What “Controlled Production Release” actually means.
Not an anonymous mass rollout
Access, operating context, deployment and responsibilities are reviewed before use. The status is not an open self-service release.
General availability remains a separate gate
Broad availability, general support commitments and standardised commercial terms are not automatically part of this product state.
No certification by wording
Controlled Production Release does not mean an independent security audit, certification, regulatory approval or approval for classified information.
The current verification state—with counts, counter-tests and boundaries.
On 9 September 2026, the current product state was re-run through the internal cryptography, key-service, browser, multi-device, database, migration and downgrade verification path. The current run covers 308 counter-test mappings; the server-side migration rehearsal checks pending migrations in a disposable clone of the running data without transferring user data off the host. Infrastructure that cannot execute a check is recorded as open and never counted as passed.
control rows with a counter-test
Every release-relevant row in the internal conformance matrix is paired with a documented negative counter-test.
browser runs / checks
The real-Chrome path covers product flows including multi-device use, concurrency, recovery, revocation and local-data removal.
concurrent prekey requests
Single-use allocation was re-run against disposable PostgreSQL; the deliberately unsafe counter-case produced duplicate allocation and was detected.
gate families in the combined evidence
Cryptography, key service, browser, multi-device, prekey concurrency, session locking, downgrade, server-side migration rehearsal, timestamps and schema alignment held in the combined current evidence.
The current public support framework.
No implied lifetime promises: version, update path and ownership must be reviewable for every deployment.
- SUP-01ACTIVE
Current release line
The current deployed state is identified through the Release Centre, signed runtime manifest and dated product evidence. Public website releases remain separate from product versions.
- SUP-02CONTROLLED
Security updates
Security-relevant changes pass through the controlled build, test, release and rollback path. Specific timelines are committed only contractually or in a published advisory.
- SUP-03NO BLANKET COMMITMENT
Previous versions
VENTEX currently publishes no blanket multi-version or long-term-support commitment. The applicable update path is agreed before deployment.
- SUP-04OPEN BEFORE GA
End of support
A general EOL calendar has not yet been published. Organisation-specific lifetime, migration and support commitments require an explicit agreement.
From report to reviewable update.
- 01
Report
Observations enter triage through the published responsible-disclosure channel with the minimum necessary data.
- 02
Triage
Scope, reproducibility, impact, affected version and remaining uncertainty are assessed separately.
- 03
Remediate and verify
Remediation, negative tests, regression, migration impact and rollback together form the release gate.
- 04
Publish in coordination
Where public notice is required, the advisory connects impact, affected versions and remediation without overstated security guarantees.
Preparation without pre-empting conformity.
The Cyber Resilience Act turns product security, vulnerability handling and update ownership into an ongoing product process. This public record is neither a declaration of conformity nor legal advice.
- Public responsible-disclosure policy and security.txt
- Dated claim ledger and explicit security boundaries
- Release Centre and signed runtime manifest
- Public status API with an explicit measurement boundary
- Machine-readable security-advisory register
- Hybrid PQXDH session establishment with ML-KEM-1024 for capable devices in the controlled version-3 rollout
- Controlled disclosure of detailed protocol and implementation material for expressly agreed confidential reviews or audits
- Dated internal verification state with 308 counter-test mappings, 19 real-browser runs and 189 browser checks
- Device revocation covers sessions, push subscriptions and subsequent account-scoped local-data removal
- Formally reviewed SBOM generation and release process
- Generally published support lifetime and EOL policy
- Independent external product and cryptography review
- External multi-region end-to-end monitoring
- Formal conformity assessment where applicable
06 / PROCUREMENT
Review the concrete operating context.
Public material enables preliminary review. Architecture, privacy, contract terms and support commitments must then be assessed for the individual organisation.