Security at Poly

PolyOS

• Firewall on: other computers can’t connect in.
• Debian security updates install automatically.
• Signed PolyOS updates: each update is signed with Poly’s release key, and PolyOS refuses one whose signature or checksums don’t match.
• One small administrator helper does the few jobs that need administrator rights, and only those.
• No remote access by default. Remote management through Poly Account is off until you switch it on at the computer.

Poly Account

• Passwords and recovery keys are stored only as salted, slow hashes (scrypt). Poly can’t read them.
• Each connected computer has its own key, stored hashed and revocable on its own. Computers never keep your password.
• Sign-in cookies are HTTP-only and secure; changes are only accepted from Poly’s own pages.
• Repeated wrong passwords are slowed down, and we email you about new devices, password changes and new recovery keys.
• See your active sessions and security activity in Poly Account › Security, and sign out other sessions there.

Report a vulnerability

Found a security problem in PolyOS, the website or Poly Account? Tell us privately through Help & Support (choose Security problem). Please give us a chance to fix it before sharing it publicly. We read every report, reply as soon as we can, and credit you if you like.

Please don’t access other people’s accounts or data, disrupt the service, or test against computers that aren’t yours.

Tips

• Use a unique password and save your recovery key somewhere safe.
• Verify your email so you get security alerts.
• Remove computers you no longer use from Poly Account › Devices.