Security
Policy
Tiritix is a precision software studio operating internationally across GPS tracking, education, AI productivity, web monitoring, and network tooling. This policy governs all interactions with Tiritix-operated systems, services, websites, and applications.
All Tiritix systems are restricted-access. Any unauthorized access, enumeration, penetration testing, reverse engineering, or automated interaction constitutes a violation of applicable law and will be prosecuted to the fullest extent permitted by German, European, and international law. No exceptions. No warnings.
Scope of This Policy
This security policy applies to all digital assets owned and operated by Tiritix, including but not limited to:
- tiritix.com — corporate website and product portfolio
- api.tiritix.com — backend API infrastructure
- map.tiritix.com — mapping and geolocation services
- myspector.com — SaaS web monitoring platform
- All mobile applications published under the Tiritix name (Xopoz, Xolorz)
- All open-source repositories maintained by Tiritix (XoSkryb, XoClock, XoPing)
Classification of Protected Data
Tiritix systems process, transmit, and store real-time and historical geolocation data of natural persons, classified as high-sensitivity personal data under applicable data protection law. Pursuant to GDPR Recital 75, location data is expressly recognized as information whose unauthorized disclosure may cause significant economic or social disadvantage to data subjects.
Geolocation data processed by Tiritix services is capable of revealing:
- Home address, workplace, and habitual places of residence of identified individuals
- Patterns of daily life, travel habits, and recurring behavioural routines
- Attendance at religious, political, medical, or other sensitive establishments
- Real-time physical whereabouts of individuals, creating direct personal safety risks
- Social and professional associations through co-location and team membership analysis
Elevated Risk Classification: Unauthorized access to geolocation data constitutes a severe personal data breach under GDPR Articles 33/34, triggering mandatory notification to supervisory authorities within 72 hours and direct notification to all affected data subjects.
Prohibited Activities
Without prior written authorization from Tiritix, the following activities are strictly prohibited and will give rise to civil and criminal liability:
- Conducting security assessments, vulnerability scans, penetration tests, or fuzz testing of any kind against any Tiritix system, website, API, or application
- Accessing, querying, or invoking any non-public endpoint, whether authenticated or unauthenticated, without a valid license agreement
- Enumerating, cataloguing, reverse-engineering, or reconstructing any API schema, route, data model, or internal architecture
- Intercepting, recording, replaying, or tampering with traffic via proxy, man-in-the-middle, or packet inspection tools
- Automated scraping, crawling, harvesting, or systematic extraction of data from any Tiritix-operated service or website
- Credential stuffing, brute-force authentication, token forgery, session hijacking, or any form of unauthorized credential exploitation
- Any interaction that degrades, disrupts, or impairs the availability, integrity, or performance of any Tiritix service
- Decompiling, disassembling, or reverse-engineering any Tiritix software product, mobile application, or backend service
Applicable Legal Framework
Unauthorized access to any Tiritix system is prosecutable under the following statutes and regulatory instruments, without limitation:
Regulation (EU) 2016/679 — Articles 5, 6, 32, and 83 — governing the lawful processing and protection of personal data, with administrative fines up to €20,000,000 or 4% of annual global turnover
Directive 2013/40/EU — Articles 3–8 — criminalizing unauthorized access to information systems, with custodial sentences up to 5 years for aggravated offences (Art. 9)
German Federal Data Protection Act (BDSG) — §42 — criminal penalties of up to 3 years imprisonment for unauthorized processing of personal data; §43 — administrative fines for negligent violations
German Criminal Code (StGB) — §202a (data espionage), §202b (interception of data), §202c (preparation of data espionage), §303a (data tampering) — each carrying custodial sentences of up to 3 years
Computer Fraud and Abuse Act (CFAA) — 18 U.S.C. §1030 — applicable to unauthorized access originating from or transiting through United States infrastructure
Convention on Cybercrime (Budapest Convention) — Articles 2–6 — international framework for prosecution of computer-related offences across 68+ signatory states
Jurisdiction & Governing Law
This policy and any dispute arising from unauthorized access shall be governed exclusively by the laws specified below. Tiritix reserves the right to pursue legal proceedings in any competent jurisdiction where the unauthorized activity originated, transited, or produced effects.
Monitoring, Logging & Evidence Preservation
All interactions with Tiritix systems are logged, monitored, and retained in accordance with our data retention policy and applicable legal requirements. Metadata collected includes, but is not limited to: source IP addresses, request timestamps (UTC), HTTP methods, URI paths, request headers, TLS fingerprints, and response codes.
Log data is preserved in tamper-evident storage and will be disclosed to law enforcement authorities, regulatory bodies, or legal counsel in connection with any investigation or proceeding arising from unauthorized access.
Right to File Criminal Complaints: Tiritix reserves the unconditional right to file criminal complaints with German and international law enforcement agencies upon detection of any attempt to probe, test, or gain unauthorized access to its systems. Under German and EU law, the mere attempt to circumvent access controls or test system defenses constitutes a criminal offence — no successful breach is required for prosecution.
Automated Detection Threshold: Any single source generating more than 100 requests within a 24-hour period to a given HTTP endpoint with varying parameters, credentials, or payloads constitutes prima facie evidence of automated unauthorized access and will trigger immediate preservation of forensic evidence and referral to law enforcement. This threshold is a factual indicator, not a safe harbour — Tiritix may file complaints for any volume of suspicious activity at its sole discretion.
Civil & Criminal Liability: Violations will result in injunctive relief, statutory damages of up to €20,000,000 or 4% of annual global turnover (GDPR Art. 83), criminal prosecution with custodial sentences of up to 5 years (Directive 2013/40/EU Art. 9), and recovery of all costs incurred in forensic investigation and legal proceedings.
Contact
To report a security vulnerability through responsible disclosure, or for licensing and compliance inquiries, contact:
Tiritix — Legal & Compliance
tiri@tiritix.com