1. Security model
Saber Vault’s current interface is a client-side application. It does not take custody of keys or assets. Security of funds depends on your wallet, your device, and the Networks you choose—not on an Operator omnibus account.
This Policy describes practices for the interface. It is not a SOC 2 report, penetration-test certificate, or insurance policy.
2. What we never ask for
Operator will not ask for your seed phrase, wallet password, private key, 2FA codes, or remote-control of your screen via the Service. Treat any such request as a scam, even if it uses Saber, Arc, Robinhood, or PulseChain branding.
The Converter’s “Authorized by” field is a typed name for a local record. It is not a cryptographic officer signature unless a later version explicitly implements one.
3. Client-side records
Mint specifications, orders, and balances stored in localStorage are available to scripts running on the origin and to anyone with access to the browser profile. Use a dedicated profile for sensitive design work. Do not use shared computers for live authorization names if those names are confidential.
XSS or a malicious extension could read localStorage. Keep the browser and extensions updated. The Service does not implement a content-security policy that would block required preview branding.
4. Wallet connection
Connect only the injected provider you intend. Review every add-network and signature prompt. Confirm chain IDs: Robinhood Chain 4663, Arc Testnet 5042002, PulseChain 369. A wrong chain can result in lost gas or lost assets.
This version does not submit Factory transactions to a live issuance contract. If a later version does, you must verify the contract address from a source you trust—not from an unsolicited message.
5. Third-party code
TradingView, font CDNs, wallet extensions, and preview-host scripts are outside Operator’s runtime. Their vulnerabilities are not Operator vulnerabilities, though they can affect your session. Disable third-party charts if your policy forbids them.
6. Network and RPC risk
Public RPCs can log IP addresses and method calls. Prefer a trusted RPC if you later send real transactions. Public RPCs (including rpc.pulsechain.com, Arc testnet RPC, and Robinhood Chain RPC) are not Operator-operated. Reorgs, pauses, and explorer errors can occur on any chain.
7. Vulnerability disclosure
If you believe you have found a vulnerability in the Saber Vault interface, describe it through Notices & Contact. Do not exploit it, do not access other users’ devices, and do not publicly post proof-of-concept that would enable theft.
Operator may patch without attribution. This is not a paid bug-bounty program unless separately announced.
8. Your responsibilities
Use hardware wallets for any real value; verify URLs; restrict who can run the Converter with real issuer names; keep counsel review off shared screens; and assume local records can be copied if the device is compromised.
9. Incidents
Because this build does not hold a user database, Operator cannot reset your wallet or freeze a public chain. The Freeze control in the Asset Profile blocks local Desk matching only. If you sign a malicious transaction, contact your wallet vendor and, if applicable, the Network’s status channels. If the interface itself is compromised, Operator may take the Service offline and post a notice in the Legal section.