Coordinated Vulnerability Disclosure Policy

Solutionsinflow GmbH | Version 1.0 | Effective: 20 August 2026

1. Purpose and Scope

This policy describes the process for reporting, assessing and remediating security vulnerabilities in products of Solutionsinflow GmbH. It applies to all products with digital elements that are manufactured, imported or distributed under its own name by Solutionsinflow GmbH.

As soon as the first products are available, you will find a current overview of our products at https://www.solutionsinflow.com/product-catalog.

2. Contact for Vulnerability Reports

Please use this channel for security reports. For general support enquiries, please contact office@solutionsinflow.com.

3. What We Expect From You

We ask finders of vulnerabilities:

• To report the vulnerability exclusively to us before it is disclosed publicly
• To give us sufficient time to remediate it (see section 5 - Timeline)
• Not to access, manipulate or modify third-party data, and not to put load on systems beyond what is necessary for verification
• Not to actively exploit vulnerabilities. A proof of concept for verification is sufficient.
• Not to carry out social engineering, spam, phishing, denial-of-service or brute-force attacks
• Not to offer tools for exploiting the vulnerability to third parties, whether for payment or free of charge
• To remain respectful when choosing a name/alias or a preferred credit for publication (no discriminatory, sexist or offensive content)

Even if you do not fully meet each of the expectations listed above, we will continue to process your report to the best of our judgement. Non-compliance merely means that you may not be credited by name in the corresponding security advisory.

4. What You Can Expect From Us

We undertake to review and assess reported vulnerabilities and, where applicable, to remediate them through security updates. We provide security updates free of charge.

Beyond that, we commit:

• To acknowledge your report within 5 working days with a simple, personal response (not an automated reply)
• To give you detailed feedback within 10 working days. This contains at least one of the following: a confirmation or rejection of the reported vulnerability, follow-up questions to improve our understanding, or, if the assessment takes longer, an explanation together with a commitment to a further update within 10 working days
• To keep you informed about the processing status on a regular basis thereafter (at least every 30 days) and to remain available as a trusted point of contact throughout the entire procedure
• To accept and review reports concerning vulnerabilities we have already remediated, even where this does not result in a full CVD procedure within the meaning of this policy
• To answer questions from you about the status of your report at any time
• To treat you with respect; there is no room for discriminatory, sexist or offensive behaviour anywhere in the reporting process - this applies to both sides
• To treat the reported vulnerability confidentially, as far as legally permissible, until a fix is available - except for the information required for public disclosure
• Not to pass on personal data of the reporting person to third parties without their explicit consent
• To offer you credit in our security advisory, if you wish
• We do not require you to sign a non-disclosure agreement (NDA)
• Not to take legal action against you if you comply with this policy

5. Timeline for Remediation and Disclosure

If there is a valid reason for a delay in remediation, we will extend this deadline once by a further 90 days in coordination with our competent national CSIRT (CERT.at).

6. Reporting Obligations Towards Authorities

We comply with our statutory reporting obligations towards authorities pursuant to Art. 14 CRA, including informing our competent national CSIRT (CERT.at) in the case of actively exploited vulnerabilities or severe security incidents.

We will inform you as the reporter once a notification to the authorities has been made, as far as legally permissible.

7. Content of a Good Vulnerability Report

For swift processing, we ask you to provide:

• Affected product/version
• Description of the vulnerability
• Steps to reproduce
• Possible impact
• Contact details (optional)

In complex cases, it may be necessary for us to ask you for further explanation or additional documentation.

8. What Counts as a Valid Vulnerability

We treat a report as a valid vulnerability if it concerns one of our products or our own infrastructure, relates to information that is not publicly known, and is not solely the result of automated tools without supporting documentation.

9. Security Advisories

Once a vulnerability has been remediated, we publish the corresponding information at https://www.solutionsinflow.com/security/advisories.

In addition, in the case of actively exploited vulnerabilities (as defined in Art. 3 No. 42 CRA) or severe security incidents (as defined in Art. 14(5) CRA), ENISA adds the reported, publicly known vulnerability to the European Vulnerability Database (EUVD).

10. Closing a Reporting Procedure

We consider a reporting procedure closed when:

• the reported findings prove to be unfounded, or
• the vulnerability has been mitigated or remediated by a suitable patch and this has been published, or
• the reporter has not responded to technical or substantive follow-up questions for at least 30 days, or
• the vulnerability is publicly known and, in coordination with our competent national CSIRT (CERT.at), it can no longer be assumed that it will be remediated or mitigated

Unless the report was submitted anonymously, we will inform you about the closure of the procedure without undue delay.

11. Safe Harbour

Solutionsinflow GmbH undertakes not to take legal action against persons who report vulnerabilities in good faith and in accordance with this policy.

12. Validity and Updates

This policy applies from 20 August 2026, displays its effective date visibly and is reviewed at least once a year.

Current version at: https://www.solutionsinflow.com/security/vulnerability-disclosure-policy.php