Security and responsible disclosure

Report a vulnerability

If you believe you have found a security vulnerability in our portal, the field controller or the protocol, please report it to us. Please give us reasonable time to fix the issue before publishing it, and do not access or modify data of others.

Report a security issue [email protected]

We confirm receipt within 5 working days and tell you how we assess the issue. When a fix is available we inform the reporter, and – if you wish – credit you.

How we handle reports, our timelines and our obligations under the EU Cyber Resilience Act: vulnerability handling policy · security.txt

What is in place

Encrypted connections (TLS) for portal and devices.
Each box has its own device certificate; revoked boxes are locked out.
Commands are signed and valid for two minutes only.
Two-factor authentication for administrators and anyone who may send commands; audit log.
A list of the software components we use (SBOM) is kept and checked against known vulnerabilities.