Support and security updates
Last updated: 15 May 2026.
This policy explains how AlfaNest Labs currently handles security-related fixes and product support for SafeKey. It is not a separate SLA unless your order form says otherwise.
Channels
Primary product surface: the public SafeKey web application and API reachable from sfk.alfanestlabs.com and api.sfk.alfanestlabs.com (exact hosts may evolve; see in-app links). Android: Google Play distribution when public. Support contact for general product questions: contact@alfanestlabs.com. Security-sensitive reports: follow the vulnerability disclosure page.
Security patches
We ship security fixes for supported versions when vulnerabilities are confirmed and remediated. Severity and exploitability determine prioritisation; critical issues affecting confidentiality or integrity of customer data receive urgent treatment where feasible.
Support period guidance
The actively maintained branch is the latest public SafeKey web/API release and the current Android store build once published. Older clients may lose compatibility after API or protocol changes; we will document material breakages in release notes where practical. A concrete calendar end date for security support may appear in checkout materials or enterprise agreements when applicable.
Dependency and infrastructure updates
Runtime dependencies (Node, frameworks, TLS endpoints, payment integrations) are updated as part of normal operations. You are responsible for keeping browsers and phones updated to receive modern TLS and Web Crypto behaviour.
No guaranteed recovery
Support does not include decryption of user data without valid credentials, forensic recovery of corrupted backups, or bypassing user-chosen protections. Preserve recovery copies of vault exports and container files offline.
Changes
We may amend this policy to reflect new legal duties (including EU CRA), product scope, or hosting changes. Material tightening of support will be reflected here with an updated effective date.