Security
Security and trust at Ossai Space
Both of our products are built for situations where being wrong about security is expensive. This page covers how to reach us about a vulnerability, and where the security properties of each product are described.
Reporting a vulnerability
If you have found a security issue in any Ossai Space product, we want to hear about it directly, and we will not take legal action against researchers who report in good faith and give us a reasonable chance to respond.
Send us the details
Email hello@ossaispace.com with enough detail to reproduce the issue — the affected product, the steps, and what you were able to demonstrate. Please do not disclose it publicly before we have replied.
We acknowledge
We aim to acknowledge every report within three working days, and to tell you whether we have been able to reproduce it.
We fix and follow up
We will keep you updated while we work on a fix, and we will tell you when it ships. We are happy to credit reporters who want the credit.
Security by product
BlackBoxNg
End-to-end encryption designed so the operator is provably unable to read content, alongside organizational membership control and audit trails, on an audited, standards-based cryptographic core.
How BlackBoxNg works →Sendsaii
One-time virtual cards limit the blast radius of a merchant breach: a card number is generated for a single purchase and retired afterwards, so leaked details are no longer chargeable.
How Sendsaii works →Security questions
- How do I report a security vulnerability?
- Email hello@ossaispace.com with the affected product, reproduction steps and what you were able to demonstrate. We aim to acknowledge reports within three working days. Please give us a chance to respond before disclosing publicly.
- Who is behind Ossai Space's products?
- Ossai Space Limited is a software product company registered with the Corporate Affairs Commission of Nigeria under RC-7847194. It builds BlackBoxNg and Sendsaii.
- Can Ossai Space read BlackBoxNg messages?
- No. BlackBoxNg content is end-to-end encrypted such that the operator is provably unable to read it. The guarantee is a property of the system rather than a promise about our conduct.
- What happens to my card details on Sendsaii?
- Sendsaii issues one-time virtual cards: a card number is generated for a single purchase and retired once that purchase completes. A card number that has already been used cannot be charged again, so a merchant breach after the fact yields nothing chargeable.