1. Separate functions, understand limits
Cuvex combines offline Bitcoin signing and secret encryption functions depending on the model and version. A security model must consider the device, firmware, phone/computer, backup media, passwords, participants and physical environment. No label—including “air gap”—by itself guarantees the absence of risks.
BIT exchanges data via USB-C and does not include NFC/Bluetooth for operation; Original uses NFC cards, USB-C for power and Bluetooth in its firmware update procedure. Always confirm the specifications of the version purchased. BIT's optional biometrics add presence conditions; they are not universal password recovery. Biometric cryptograms require the devices and credentials stated in their documentation.
2. Before using funds
Check the equipment's origin, the contents received and the official instructions. Do not set up the device with a pre-written seed supplied by a third party. Do not use a demonstration seed or a secret you have shared through chat, email or a website. Verify recovery and first perform an appropriately sized test transaction.
To authorise an operation, review the device's screen: address, network, amount, fees and relevant details. Do not assume a transaction is safe because it appears in a trusted app. Threats to software distribution and dependencies may affect even a familiar interface.
3. Backups and recovery
Keep sufficient backups on compatible media, protected against loss, unauthorised access and damage. Document which passwords, participants, hardware and versions recovery requires. Do not keep all credentials beside the only copy. Test the procedure without exposing real assets or your only backup.
Cryptogram decryption thresholds are not equivalent to a Bitcoin multisig transaction. Standard media, 8K cards and USB backups have different capacities. The dice-and-coin procedure depends on following instructions and on the physical items used; it is not an absolute mathematical promise of the quality of every execution.
4. Updates and supply chain
Use the official channels identified by Cuvex. Be wary of urgent messages asking you to install an update, enter a seed or “synchronise” a wallet on a website. Cuvex will not ask for your private keys to process a warranty claim or verify a purchase.
The announced support period for each model must appear in its listing before sale. Where appropriate, we will publish corrective measures and authenticity and compatibility instructions. If you receive equipment showing signs of tampering, stop use, retain non-secret evidence and contact support. The mere presence of packaging or a seal does not prove that equipment is safe.
5. Reporting a vulnerability or incident
Send a message to sato@cuvex.io with the subject “Security”, the model/versions, a description, minimal reproducible steps and the known scope. Do not include real secrets, buyer data, destructive tests or information obtained by accessing other people's accounts. To exchange sensitive material, first request an appropriate channel.
Coordinated disclosure aims to allow investigation and remediation without increasing harm. We do not make compliance with legal obligations conditional on a confidentiality agreement, nor do we promise rewards that have not been published. Research must respect the law and authorised access.
6. Response and communication
We will separately assess the impact on products, software, the supply chain and commercial data. We will maintain traceability of decisions, responsible people and measures. Where appropriate, we will inform buyers, authorities and other recipients according to applicable timeframes and criteria. We do not promise that every incident can be detected immediately or that a notice implies loss of assets.
Tidy Money LLC's obligations and liability for its products and services are not removed by the involvement of a supplier, carrier or attacker. This information supplements, without reducing, the terms of sale and mandatory rights.
Payments and scope of this version
New orders have a USD reference price. BTC is accepted through BTCPay Server and, only when enabled, native USDC on Solana through Cuvex SCP. Card payments are not offered. The sales terms govern exchange quotes and refunds. This version does not retrospectively change contracts or rights arising from earlier purchases.