Vulnerability disclosure policy
At Rometron, we take the security, safety and reliability of our products, software and services seriously. We welcome reports from customers, partners, researchers and anyone else who identifies a potential security vulnerability. If you act in good faith and follow this policy, Rometron will not pursue legal action against you for identifying and reporting it.
This vulnerability disclosure policy explains how you can report a vulnerability and how Rometron handles your report.
Scope
This policy applies to:
●Rometron products and systems
●Cloud services operated by Rometron
Third party products and services fall outside this scope. Please report those issues directly to the relevant vendor.
Reporting a vulnerability
Think you’ve found a security vulnerability? Report it to us at security@rometron.nl.
To help us investigate quickly, please include where possible:
●A description of the vulnerability
●The affected product, service or software version
●Steps to reproduce the issue
●The potential impact
●Screenshots, logs or proof of concept material
●Your contact details, so we can follow up
Our commitment
When you report a vulnerability, Rometron will:
●Review and assess every report
●Treat your information confidentially
●Investigate and validate the reported vulnerability
●Prioritise remediation based on severity and risk
●Coordinate disclosure where appropriate
Response targets
We aim to:
●Acknowledge receipt of your report within 24 hours
●Share an initial assessment within 72 hours
●Keep you informed of significant progress, where appropriate
Response and remediation times can vary depending on the complexity, severity and scope of the reported vulnerability.
Responsible disclosure
We ask security researchers and reporters to:
●Act in good faith
●Avoid any action that could affect the availability of our systems or services
●Never access, modify or delete data that isn’t yours
●Avoid activities that could negatively affect our customers, users or operations
●Give Rometron reasonable time to investigate and remediate an issue before disclosing it publicly
Vulnerability management
We review and process every reported vulnerability in line with Rometron’s internal vulnerability management procedures. Valid vulnerabilities are assessed, prioritised and remediated based on their severity, potential impact and associated risk.
Where appropriate, Rometron coordinates disclosure with customers, partners, suppliers, researchers and relevant authorities.
Regulatory compliance
Rometron complies with applicable cybersecurity legislation and regulatory requirements, including the European Cyber Resilience Act (CRA). Where legally required, we report vulnerabilities and related security incidents to the relevant authorities.
Questions or a vulnerability to report?
Thank you for helping us keep Rometron’s products and services secure.