Security Policy

The security of Nexus Telemetry™ and our users' data is important to us. This page explains how to report security vulnerabilities and what to expect from the process.

Last updated: March 2026

Reporting a Vulnerability

If you've found a security vulnerability in Nexus Telemetry, the Nexus website, or the Nexus API, please report it responsibly. Do not disclose it publicly until we've had a chance to investigate and address it.

Email: [email protected]

Subject line: Security Vulnerability Report

Please include as much of the following as you can:

  • •A description of the vulnerability and its potential impact
  • •Steps to reproduce the issue
  • •The affected component (desktop application, website, API, customer portal)
  • •Your application version, operating system, and any relevant configuration
  • •Any supporting evidence (screenshots, logs, proof-of-concept code)

What to Expect

  • Acknowledgement: We aim to acknowledge your report within 2 working days.
  • Assessment: We will investigate and assess the severity of the issue. We may contact you for additional information.
  • Resolution: We will work to resolve confirmed vulnerabilities as quickly as possible, prioritising based on severity.
  • Notification: Once resolved, we will let you know. For significant issues, we will publish a note in our release changelog.

Scope

The following are in scope for responsible disclosure:

  • •Nexus Telemetry desktop application (all platforms)
  • •nexustelemetry.com (marketing website)
  • •account.nexustelemetry.com (customer portal and API)

The following are out of scope:

  • •Starlink hardware, firmware, or SpaceX services — please report these directly to SpaceX
  • •Third-party services we use (Stripe, Cloudflare, SendGrid, etc.) — please report these to the respective providers
  • •Social engineering, phishing, or physical attacks
  • •Denial-of-service attacks
  • •Automated scanning without prior coordination

Safe Harbour

We will not take legal action against individuals who discover and report security vulnerabilities in good faith, provided they:

  • •Make a reasonable effort to avoid accessing or modifying data that doesn't belong to them
  • •Do not exploit the vulnerability beyond what is necessary to demonstrate the issue
  • •Do not disclose the vulnerability publicly before we've had a reasonable opportunity to address it
  • •Do not use the vulnerability to access, modify, or delete other users' data

Security Practices

While we don't disclose the details of our security architecture, here is an overview of the measures we take:

  • All data in transit is encrypted via HTTPS (TLS)
  • Payment processing is handled entirely by Stripe — we never see or store payment card details
  • Customer portal authentication uses short-lived magic links rather than passwords
  • The desktop application communicates with your Starlink terminal over your local network only — no telemetry data passes through our servers

Contact

For security-related reports or questions:

Email: [email protected]

Company: Liquidbinary Ltd

Registration: Scotland, SC370778

Location: United Kingdom