# Ewii Secure MCP VPN — Security Disclosure
# RFC 9116 — https://datatracker.ietf.org/doc/html/rfc9116
#
# Vendor: Delta Telematics Canada Inc.
# Product: Ewii Secure MCP VPN
# Deployment model: self-hosted (operator runs control plane + relay nodes;
#                    customer runs tunnel-agent; Delta Telematics Canada operates no runtime
#                    component of any deployment).

Contact: mailto:security@delta-telematics.ca
Contact: https://ewii.delta-telematics.ca/trust

# PGP public key for encrypted disclosure.
# Fingerprint: A186 9048 F5F7 18EE E885  B16F 873B 4429 FB79 1B25
# Algorithm:   Ed25519 (signing) + Cv25519 (encryption)
Encryption: https://ewii.delta-telematics.ca/.well-known/security-pubkey.asc

# This file expires one year from issuance. Re-publish before this date.
Expires: 2027-05-11T00:00:00Z

Acknowledgments: https://ewii.delta-telematics.ca/trust#acknowledgements
Policy: https://ewii.delta-telematics.ca/trust#vulnerability-disclosure
Preferred-Languages: en, fr
Canonical: https://ewii.delta-telematics.ca/.well-known/security.txt

# Vendor sub-jurisdiction: Canada (federal incorporation, Fredericton NB
# registered office). No US extraterritorial exposure, no US subsidiary,
# no US-headquartered parent.
#
# Full Trust Center pack (PDF, behind a 3-field form for lead-gen):
#   https://ewii.delta-telematics.ca/api/trust-center-download
#
# Machine-readable companion manifest (openly served for procurement
# automation; same data as the PDF in structured form):
#   https://ewii.delta-telematics.ca/trust-center-manifest.json