IOActive — independent third-party security assessment of MAXHUB OS

Question we hear most often: "You are a Chinese-headquartered brand. Our security team needs independent technical evidence that the device won't communicate with servers we don't expect, and that the operating system is hardened to a recognisable standard. What can you provide?"

Short answer: an independent third-party security assessment by IOActive, one of the longest-established cybersecurity consultancies in the world. The assessment covered the geographic distribution of servers the system communicates with, network-level security, and application-layer security.

Why IOActive specifically

IOActive was founded in 1998. With over 25 years of experience, its areas of practice include IT infrastructure assessments, application security source-code and architecture reviews, ICS/SCADA assessments, and emerging-market evaluations across cloud, embedded, and connected-device environments. The firm's clients include Global 500 organisations across financial services, healthcare, industrial, retail, and technology sectors.

Engagement details

• Scope — MAXHUB OS running on the XBoard V7 interactive flat panel.
• Assessment period — 12 to 19 January 2026.
• Activities — network scanning; analysis of the geographic distribution of servers the system communicates with; web application and services assessment covering authentication, session management, data validation, and server configuration.

Headline finding

From the IOActive assessment letter: "IOActive observed that the system did not communicate with any servers in China during the test."

This is the question European customers ask us most frequently. We chose to have it answered by an independent third party rather than answer it ourselves.

On vulnerability findings and remediation

Penetration tests find issues. That is what they are designed to do. Our IOActive engagement was no exception. The full assessment letter is available under NDA. MAXHUB has worked through the recommendations from this engagement and has a follow-up validation engagement planned.

How to obtain the assessment letter

The IOActive third-party assessment letter is restricted-use under IOActive's terms. Available to qualifying customers and prospects under a non-disclosure agreement. Submit a request via the document library.