VirtuCath for IT Departments

On this page

1. Intended use & scope
2. Publisher identity
3. Code-signing certificate
4. Certificate renewal & timestamp policy
5. Installer integrity hashes
6. System requirements
7. Antivirus / EDR false-positive guidance
8. Silent / scripted deployment
9. Enterprise mode
10. Network allowlist
11. Data handling, telemetry & privacy
12. Vulnerability management & disclosure
13. Subprocessors
14. Personnel, operations & business continuity
15. Compliance attestations & SBOM
16. Support contact

1. Intended use & scope

VirtuCath is a desktop simulation tool intended as a design aid for research and development of deflectable micro-catheters. It is not, and must not be used as:

• A clinical decision-making tool;
• A substitute for formal medical-device Verification & Validation (V&V);
• A regulatory-submission artefact in lieu of physical testing;
• A processor of Protected Health Information (PHI) — we do not sign HIPAA Business Associate Agreements.

Engineering inputs (catheter geometry, material properties, simulation parameters) are not PHI and are unaffected by this restriction. Full intended-use language is in EULA §1; the limitation-of-liability treatment is in EULA §10.3.

For procurement reviewers: this scope deliberately keeps VirtuCath outside the FDA medical-device regulatory perimeter, the HIPAA covered-entity perimeter, and any clinical-system audit obligations. Treat it like a CAD/CAE tool, not a clinical platform.

2. Publisher identity

The VirtuCath installer is published by VirtuCath, LLC, a limited liability company registered in the State of Minnesota, United States. The legal entity name appears as the Common Name (CN) and Organization (O) on our code-signing certificate.

3. Code-signing certificate

All VirtuCath release binaries (the VirtuCath-<version>-Setup.exe installer, VirtuCath.exe, and the bundled pyarmor_runtime.pyd) are digitally signed with an Organization Validation (OV) code-signing certificate issued by SSL.com and signed via the SSL.com eSigner cloud signing service. The OV process required SSL.com to independently verify the legal existence and operational identity of VirtuCath, LLC before issuance.

How to verify the certificate yourself

On a Windows machine with the signed installer downloaded, run the following in PowerShell. The values that print MUST match the table above. If they do not, the binary you downloaded was not produced by VirtuCath, LLC and should not be installed.

4. Certificate renewal & timestamp policy

All release signatures include an RFC 3161 timestamp countersignature applied by SSL.com's timestamp authority at the moment of signing. The practical consequence: signatures on binaries shipped before the certificate's NotAfter date remain Authenticode-valid indefinitely, even after the underlying certificate expires. Authenticode policy explicitly grandfathers timestamped signatures past their cert's expiry.

The current certificate expires on the Valid until date in the previous section. Renewal will be initiated at least 30 days before that date. When the cert is renewed:

• Existing customers' installed copies continue to verify cleanly — the old signatures are timestamp-protected;
• New releases will carry signatures from the renewed certificate, with new SHA-1 / SHA-256 thumbprints;
• This page will be updated with the new thumbprints (via build_and_sign.py's auto-update routine) and a note in the CHANGELOG.

For audit purposes: the signature on each release was applied at the time the build was produced (you can read the exact UTC timestamp from (Get-AuthenticodeSignature *.exe).TimeStamperCertificate.NotBefore), not at the time you downloaded the file.

5. Installer integrity hashes

SHA-256 hashes of each VirtuCath installer release. Compute the hash locally with Get-FileHash <installer.exe> -Algorithm SHA256 and compare against the value below before deploying. Hashes for retired versions are kept for historical / audit reference.

Older 0.9.x setup files are not listed and are no longer supported. Customers on those versions should upgrade to 1.0 via the standard installer.

6. System requirements

7. Antivirus / EDR false-positive guidance

VirtuCath is built with PyInstaller (Python packaging) and PyArmor (Python bytecode obfuscation). Both produce binary signatures that several aggressive AV / EDR products historically flag on heuristic grounds, even though the underlying executable is benign and signed. Specific vendor / engine combinations vary — we deliberately do not maintain a public list of "products that flag us," because that list rots between signature updates. Behaviour varies by engine version, signature update state, and policy aggressiveness.

If your EDR flags VirtuCath

1. Confirm it is actually our binary before doing anything else. Run the PowerShell verification snippet in §3; the SHA-1 and SHA-256 thumbprints MUST match this page. A legitimate VirtuCath build is Authenticode-signed by CN=VirtuCath LLC, O=VirtuCath LLC. If the thumbprints do not match, do not allowlist — treat the file as untrusted and contact us.
2. Allowlist by publisher cert, not by filename or hash. Allowlisting by hash is brittle (changes every release); allowlisting by filename is unsafe (a malicious binary with the same name would also be trusted). Allowlist-by-publisher-cert means "trust files signed by VirtuCath, LLC" — most enterprise EDRs (CrowdStrike, Defender for Endpoint, SentinelOne) support this. Reference the SHA-1 thumbprint in §3 when configuring the rule.
3. Submit the sample to your AV vendor as a false positive. The signed installer + the cert thumbprints are sufficient evidence for any reputable vendor to clear the false positive within their next signature release. This benefits every other customer running the same EDR.
4. Get in touch. If you need a copy of the build artefacts for your security team's analysis, or a written attestation to attach to a ticket with your AV vendor, email support@virtucath.com with [IT][AV-FP] in the subject line.

We do not submit binaries to AV vendors pre-emptively (the signature-update churn would produce more false positives than it solves). Reactive remediation via the steps above has historically resolved every reported case.

8. Silent / scripted deployment

The Inno Setup installer supports unattended deployment via standard Inno command-line switches. The most common patterns:

Per-machine install for all users (SCCM / Intune)

Installs to C:\Program Files\VirtuCath\. Requires administrator privileges. No UAC prompts. No reboot.

Per-user install (no admin rights required)

Installs to %LOCALAPPDATA%\Programs\VirtuCath\. No administrator rights needed.

Silent uninstall

Useful additional switches

The choice of /ALLUSERS vs /CURRENTUSER is remembered across upgrades (Inno's UsePreviousPrivileges=yes), so a subsequent upgrade installer launched without flags will respect the original install scope. This is the recommended behaviour for fleet rollouts: deploy once with /ALLUSERS /SILENT, and future updates pushed by the same mechanism will land in the same location.

9. Enterprise mode

VirtuCath supports a machine-wide "enterprise mode" that disables the auto-updater (IT pushes updates instead), defaults the bug-report tool to local-save only, and excludes the user's catheter configuration from diagnostic bundles by default (engineering IP exfiltration risk). Activate via Group Policy / Intune by setting:

Or in PowerShell during deployment:

Users can verify enterprise mode is active by opening Help → About; the "Deployment" line will read "Enterprise mode (via machine-wide registry policy)".

Full enterprise-mode setup, including environment variable and license-tier detection, is documented in the IT Deployment Guide.

10. Network allowlist

VirtuCath is largely an offline desktop application. The only outbound network traffic from a deployed install:

All traffic is HTTPS with TLS 1.2 minimum. Proxy environments are supported via the standard HTTP_PROXY / HTTPS_PROXY environment variables. The app does not bypass system proxies.

If your network performs TLS interception (a common pattern for next-gen firewalls), our HTTPS calls will fail certificate verification and the auto-updater's Authenticode check on the downloaded installer will also fail. Either allowlist virtucath.com and *.cryptlex.com to bypass interception, or install your corporate root CA into the machine's Windows trust store before deploying VirtuCath.

11. Data handling, telemetry & privacy

No telemetry. VirtuCath installs do not phone home for product analytics, usage tracking, crash counts, or any background data upload. The only outbound network traffic is exhaustively listed in §10. We do not embed Google Analytics, Meta Pixel, LinkedIn Insight, Sentry, Mixpanel, PostHog, Segment, or any other analytics / observability SDK in the desktop application.

Data residency. When VirtuCath does make a network call (license validation, update check, or a user-submitted bug report), the receiving infrastructure is located in the United States:

• License validation: Cryptlex (US / global anycast).
• Backend API + installer hosting: Cloudflare (US-region D1, R2, and Workers).
• Payment processing: FastSpring (Merchant of Record, headquartered in the US).

For EU / UK / Swiss customers, transfers rely on Standard Contractual Clauses (EU Decision 2021/914) plus the UK ICO International Data Transfer Addendum. See the Privacy Policy §6A for the full transfer mechanism.

Bug-report contents. When a user submits a bug report via Help → Report a Problem, the diagnostic bundle they upload (or save locally) is automatically redacted client-side: license keys, hardware identifiers, foreign email addresses, and user-home filesystem paths are masked before the bundle leaves the machine. The user's catheter configuration is opt-in (and OFF by default in enterprise mode — see §9).

Encryption. All in-transit traffic uses TLS 1.2 or higher. Stored bug-report bundles are kept in Cloudflare R2, which encrypts objects at rest by default. Local session logs on the user's machine are unencrypted plain text (they need to be readable by the user / support during diagnostics) but live inside the user's profile and are subject to whatever full-disk encryption (BitLocker etc.) you have applied at the OS level.

PII minimisation in the event archive. Cryptographically verified webhook payloads from FastSpring and Cryptlex are archived to R2 for vendor-independent disaster recovery (the events/ bucket prefix). Customer PII is removed before write: email addresses are replaced with their HMAC-SHA256 hash (keyed by a server-side pepper that never leaves the worker secret store); first / last names, addresses, phone numbers, IP addresses, and company names are dropped entirely. Order IDs, license IDs, subscription IDs, plan, and timestamps are retained so a license-issuance event can be reconstructed if Cryptlex ever becomes unavailable. The archive is bounded by the 90-day lifecycle rule below; the pseudonymisation layer bounds it further — even if the bucket were exposed, raw customer identities could not be recovered without also obtaining the hashing pepper.

Local log contents. Session logs at %LOCALAPPDATA%\VirtuCath\logs\ capture: application version, OS version, Python tracebacks, OpenGL renderer string, simulation parameters the user entered, and timing statistics. No Protected Health Information (PHI) is captured by design — the application has no PHI input surface (see §1). License keys and hardware identifiers are redacted at the logging layer. Logs rotate at 10 MB per file with 5 rotated copies retained, then the oldest is overwritten. Logs are never transmitted off-device unless the user explicitly initiates a bug report.

Retention. Server-side data is retained on the following schedule. Bug-report and backup retention are enforced by Cloudflare R2 object-lifecycle rules, so deletion is automatic and auditable:

Deletion on request. Customers may request earlier deletion of a specific bug-report bundle by emailing support@virtucath.com with the bundle's report ID (printed in the on-screen confirmation and in the notification email). Deletion is completed within 5 business days. End-user data-subject rights (access, deletion, portability) under GDPR / CCPA / state privacy laws are handled through the process described in the Privacy Policy §9.

Right-to-be-forgotten procedure for license customers. When a paid customer requests erasure under GDPR or CCPA, our internal procedure removes their records from each system that holds them: (1) HubSpot Contact and all associated Deals and Notes; (2) Cryptlex license metadata is anonymised (the license itself is preserved for the refund-window audit period per the row above, but PII metadata is stripped); (3) the R2 event archive is searched by the customer’s HMAC-hashed email and any matching objects are deleted. Steps (1)–(3) are completed within 30 calendar days of a verified request, per Article 12(3) GDPR.

12. Vulnerability management & disclosure

We welcome reports of security vulnerabilities in VirtuCath or in our backend infrastructure. To report:

• Email support@virtucath.com with subject line beginning [SECURITY].
• Or use the structured contact at virtucath.com/.well-known/security.txt (RFC 9116).

We commit to:

• Acknowledging your report within 3 business days.
• Providing an initial triage outcome (severity, validity, planned action) within 10 business days.
• Coordinating disclosure timing with you. Our default is 90 days from triage acknowledgement, shortened if a patch ships earlier or extended by mutual agreement.
• Crediting your name (or pseudonym, or anonymity, your choice) in the CHANGELOG when a fix ships, unless you ask us not to.

We do not currently run a paid bug-bounty program. Good-faith research conducted under this policy will not result in legal action.

Remediation SLA

Once a vulnerability is confirmed, we commit to publish a fixed release within the following targets. Severity is assessed against CVSS 3.1, with the exploitability context of a Windows-desktop simulation application that does not handle PHI or financial data:

These are publication targets, not contractual SLAs. We will communicate slippage and the reason for it before the deadline elapses.

Secure development practices

VirtuCath's build pipeline applies the following controls before any binary is released to customers:

• Pinned dependencies. Python requirements are pinned by version in requirements.txt; upgrades are intentional and recorded in the CHANGELOG, not the byproduct of a "latest" floating tag.
• Dependency transparency. The CycloneDX SBOM shipped with the installer (§15) lists every direct and transitive dependency. The SBOM is suitable for ingestion into pip-audit, Snyk, or any other CVE scanner your security team already operates — you can run your own scan against our locked dependency set, on your own cadence, against your own choice of vulnerability database. We commit to publishing a patched release on the SLA in the previous table once a CVE that materially affects VirtuCath is reported to us.
• Secrets handling. Runtime secrets (Cryptlex tokens, Cloudflare API tokens, FastSpring webhook secret, signing-certificate PIN) are stored in wrangler secret put on the Cloudflare side and in the OS credential store on the build machine; they are never written to source-controlled files. The signing-cert PIN never leaves the build machine — SSL.com's eSigner performs the actual signature server-side, gated by a TOTP submitted by the build script.
• Reproducible installer hashes. Every release records the installer SHA-256 in a release manifest, and the same hash is published in §5 of this page. Any customer with the installer can verify independently that the file they received is the byte-identical one we built.
• Code signing at the moment of build. Authenticode signing (§3) occurs inside the build pipeline; unsigned binaries cannot leave the build host.

For non-security operational issues (crashes, deployment errors, license problems), use the regular support channel in §16 below.

13. Subprocessors

The following third parties process VirtuCath data on our behalf. All processing relationships are governed by the vendor's published Data Processing Addendum (DPA), incorporating Standard Contractual Clauses for any EU/UK/Swiss-origin data:

Adding or replacing a subprocessor with material customer-data access will be announced on this page at least 30 days in advance, with the customer right to terminate for cause within that window (per the standard Article 28 GDPR pattern). Subscribe to the CHANGELOG to receive these notices.

14. Personnel, operations & business continuity

Personnel

VirtuCath software development is performed by employees of VirtuCath, LLC under written confidentiality obligations. No source-code development is subcontracted to third parties. Access to production systems (Cloudflare account, Cryptlex tenant, FastSpring store, signing-certificate custody) is limited to authorised employees, secured with multi-factor authentication (TOTP), and re-reviewed on any change in personnel assignment.

Removed for brevity. Founders and any employees with production-system access have a clean record on public US criminal-background databases at the time of engagement; formal third-party background-check vendors are not currently engaged at our headcount. Security training is conducted informally given team size; we will move to a formal annual programme (OWASP Top 10, secure-SDLC refresher) when headcount warrants it.

Business continuity

VirtuCath is a desktop application that continues to function fully offline. If our backend (Cloudflare Workers + D1) becomes unreachable for any reason — outage, DNS failure, our company ceasing operations — existing installations:

• Continue to launch, simulate, and export results normally for the duration of the server-sync grace period defined in our Cryptlex license policy, measured from the last successful license check.
• Cannot activate new machines and cannot auto-update until backend access is restored. The current installer remains usable; customers retain the .exe they downloaded.
• Continue to operate in “enterprise mode” (§9) without any backend dependency at all once activated.

This design intentionally minimises business-continuity risk for IT teams: a VirtuCath vendor outage does not stop your engineers from working.

Data backup & recovery

The backend D1 database (license records, order metadata) is backed up weekly to Cloudflare R2 under the backups/ prefix with 365-day retention (§11). Backup integrity and restore procedures are tested as part of our release-engineering process. Detailed RTO/RPO targets are available on request for procurement reviewers under NDA.

Insurance

Details of in-force cyber-liability and technology errors & omissions coverage are available on request under a mutual NDA. Email support@virtucath.com with subject line beginning [IT][Insurance].

Penetration testing & threat modelling

We have not yet commissioned an external penetration test of the backend or the desktop application at this stage. An internal threat model is maintained and is available to enterprise customers under NDA on request.

15. Compliance attestations & SBOM

VirtuCath is a small-ISV desktop tool. We do not currently hold formal third-party attestations against any of the following frameworks:

• SOC 2 Type I or Type II
• ISO/IEC 27001 / 27017 / 27018
• FedRAMP (any impact level)
• HIPAA covered-entity / business-associate certification (we do not sign BAAs)
• PCI DSS (we do not store, process, or transmit cardholder data — FastSpring handles payment processing as the Merchant of Record)
• StateRAMP, IRAP, ENS, C5, or comparable regional public-sector frameworks

Many of these frameworks are inapplicable to a desktop simulation tool that does not handle PHI, financial data, or government information; others are roadmap items we will pursue as enterprise demand justifies. If you require a specific attestation as part of procurement, contact us — we are happy to discuss timing and whether a contractual representation can stand in for a third-party audit.

SBOM. A CycloneDX 1.6 Software Bill of Materials (virtucath.cdx.json) is shipped in the install directory alongside EULA.txt and THIRD_PARTY_NOTICES.txt. The SBOM is regenerated by the build script on each release from the actual Python environment used to build the binary; it lists every direct and transitive dependency with its version, license, and PURL identifier. This satisfies the SBOM requirement of US Executive Order 14028 and most CISA "Secure Software Development" attestation forms.

Code-signing. Authenticode signing with an OV certificate (§3) satisfies most "is this binary trustworthy?" controls in procurement questionnaires. The setup EXE is signed; the embedded uninstaller stub is currently unsigned for release 1.0.0-rc.1 (a planned 1.0.1 change — see CHANGELOG under Known limitations).

Penetration testing. We have not commissioned an external penetration test against the backend (Cloudflare Workers) or the desktop application at this stage; see §14 for the internal-threat-model status. Plans depend on enterprise customer demand.

Accessibility. The desktop UI has not been formally tested against WCAG 2.1 AA. The application is operable by keyboard for primary workflows; full screen-reader compatibility has not been verified. Federal Section 508 conformance is not asserted — if your procurement requires a VPAT, contact us.

Export control. VirtuCath is classified as EAR99 under US Export Administration Regulations: it is commercial off-the-shelf simulation software, contains no encryption beyond standard TLS, and is not specifically designed for any controlled end-use. No export license is required for shipment to most destinations. Customers in OFAC-embargoed jurisdictions are restricted by the EULA.

16. Support contact

For IT-specific questions (deployment errors, fleet rollout planning, custom installer requirements, audit/compliance documentation, SBOM requests, AV-allowlisting attestations), email support@virtucath.com with the subject line beginning [IT]. For security vulnerabilities specifically, use the channel in §12.

For end-user product questions (how to use the application, simulation results, licensing activation), the same email address works without a subject prefix.