The EU Cyber Resilience Act (CRA) requires manufacturers of digital products to provide a means for reporting security vulnerabilities identified in their products and services.

At Idesco, information security is guided by our ISO 27001-certified security management practices. We continuously monitor and improve the security of our products and services. However, if you discover a potential security vulnerability in any of our products or services, we encourage you to report it to us. We will investigate all reports and address confirmed issues as promptly as possible.

Reporting a security vulnerability

If you discover a potential security vulnerability related to Idesco products or services, we encourage you to report it responsibly by email to:

[email protected]

Please include the following information whenever possible:

• Product or service concerned.
• A clear description of the identified vulnerability.
• Information on how the vulnerability can be reproduced.
• Relevant technical details, such as URLs, API calls, HTTP headers, or log information.
• An assessment of the potential impact on the product, system, or users.

Please do not send attachments unless specifically requested.

Responsible disclosure guidelines

When investigating potential vulnerabilities, we ask that you:

• Comply with all applicable laws and ethical security research practices.
• Do not exploit the vulnerability to gain unauthorized access to systems, data, or services.
• Do not modify, delete, or copy any data.
• Do not use testing methods that could disrupt services or cause unnecessary load on our systems.
• Do not disclose vulnerability details publicly or to third parties until the issue has been investigated and appropriate remediation measures have been implemented.

How we handle reports

When we receive a vulnerability report, we will:

• Acknowledge receipt as soon as reasonably possible, typically within a few business days.
• Assess the reported issue and initiate any necessary investigation and remediation activities.
• Keep the reporter informed about the progress of the case when appropriate.
• Notify the reporter when the issue has been resolved, provided that feedback has been requested.

We value responsible security research and appreciate all reports that help improve the security and reliability of our products and services.

Thank you for helping us maintain a secure environment for our customers and partners.