Cyber Vulnerability Disclosure

This policy serves as a guide for the responsible identification and reporting of vulnerabilities. It explains how to report potential security vulnerabilities to us in a structured manner and how we handle such reports together with you.

Here, you’ll learn how to report vulnerabilities to us, what information we need, and what the next steps are. Our goal is to work together to find solutions—before the information becomes public.

If you discover security vulnerabilities in our products, we strongly encourage you to report them to us confidentially first. Please give us the opportunity to analyse and resolve the issue before it is made public.

To report product vulnerabilities, please contact us at [Add email]

As a token of our appreciation, we are happy to acknowledge reported vulnerabilities and, upon request, mention them by name.

Authorised Security Research

We welcome reports of potential vulnerabilities in our products and digital components. Anyone who conducts security research responsibly and adheres to the principles outlined in this policy is acting in our best interests.

If you proceed to the best of your knowledge, carefully, fairly, and without malicious intent, we will consider your investigation to be authorised security research. Our goal is to work with you to quickly understand and assess reported vulnerabilities and to take appropriate steps to address them.

Guidelines for Responsible Reporting

For the purposes of this policy, we define responsible security research to mean, in particular, that you:

• Please notify us as soon as possible if you discover an actual or potential vulnerability.
• Conduct tests only to the extent necessary to verifiably confirm a vulnerability.
• Do not modify, delete, copy, or disclose any data without authorisation.
  Do not interfere with any systems, services, or users.
• Give us enough time to analyse the vulnerability and provide a solution before any information is made public.
• Refrain from using automated bulk notifications or reports that lack a sufficient technical basis.

We expressly ask that you not disclose any vulnerabilities you discover without prior consultation. Please give us the opportunity to carefully review the issue and implement appropriate protective measures.

You can find out the best way to report vulnerabilities here.

Legal Protection (Safe Harbour)

FläktGroup welcomes and supports responsible security research. We will not take legal action against individuals who report potential vulnerabilities in good faith and adhere to the principles outlined in this policy.

This is contingent upon security tests being conducted responsibly, no disruption to systems, data, or users occurring, and any vulnerabilities discovered being reported to us confidentially. Premature or uncoordinated public disclosure must be avoided.

We ask that you allow us sufficient time to analyse and address the reported vulnerability. In this context, we consider such activities to be authorised security research as defined in our Vulnerability Disclosure Policy.

Scope of Application

This policy applies to products, software, firmware, and digital components from FläktGroup, particularly in the context of building automation and control technology.

It covers all systems and solutions developed, operated, or managed by FläktGroup. The goal is to systematically record safety-related information and enable the efficient processing and assessment of potential vulnerabilities.

The scope of application includes, in particular:

• DDC Controllers and Automation Stations
• Firmware, embedded software, and product-specific applications
• Digital interfaces, communication protocols, and network connections (e.g., BACnet-based systems)
• Product-related tools, configuration software, and supporting components
• Features and services directly related to our products
• Third-party and open-source components, to the extent that they are part of a FläktGroup product

If third-party or open-source components are affected, we will contact the manufacturer or maintainer and monitor how they address the issue.

This policy does not apply to third-party systems, applications, or services that are not developed, operated, or managed by FläktGroup. This includes, in particular, external platforms, infrastructure components, or integrations outside our control.

If you are unsure whether your report falls under this policy, you can still contact us at any time. We will carefully review your enquiry and, if necessary, forward it to the appropriate department.

What You Can Expect From Us

If you report a vulnerability to us and provide your contact information, we will handle your report in a transparent, structured, and responsible manner.

You will receive an acknowledgement of receipt immediately, so you'll know that we've received your report. An initial technical assessment will be conducted immediately after the initial review. We will then investigate the reported vulnerability together with the relevant departments, development teams, and, if necessary, partners.

Further disclosures will be coordinated and will depend on when a suitable solution, an update, or appropriate protective measures can be made available. Our goal is to responsibly address security vulnerabilities before information is made public.

Please note: We can only provide you with clear feedback on the status of your report if you include your contact information in your email.

You can find the latest reports here.

Publication and Recognition

If a reported vulnerability is confirmed, we carefully coordinate the next steps. We generally do not make the vulnerability public until a suitable solution, an update, or another protective measure is available, or until we have coordinated with the relevant parties.

Depending on the nature and severity of the vulnerability, the disclosure may take the form of a security advisory, for example. If necessary, we coordinate with the appropriate coordinating bodies or partners.

We value the contributions of responsible security researchers. Upon request, we will be happy to consider including a byline or acknowledgement in the publication.