Coordinated Vulnerability Disclosure Policy

Policy

1. Purpose

The security of CONZE Informatik GmbH products, software and digital services is a high priority. Nevertheless, vulnerabilities cannot be completely excluded, even where products are developed carefully and tested regularly. This policy explains how security researchers, customers, partners and other individuals can confidentially report potential vulnerabilities to us. Its purpose is to enable reported vulnerabilities to be investigated, remediated and disclosed in a coordinated manner.

This policy supports our vulnerability-handling process and our obligations under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA).

2. Scope

This policy applies to the following products and services for which we are responsible:

• vistrax – the digital visitor book
• Server software, desktop software, web-clients and mobile apps
• Managed cloud services
• vistrax.com domain and subdomains
• Help desk / FAQ

Unless expressly stated otherwise, the following are out of scope:

• Third-party systems or services for which we are not responsible;
• Internal systems that are not publicly accessible;
• Social-engineering attacks against employees, customers or partners;
• Physical attacks against premises, equipment or individuals;
• Denial-of-service or distributed-denial-of-service attacks;
• Automated testing that may affect system availability or stability.

If you are unsure whether a system is within scope, please contact us before conducting further testing.

3. Reporting a Vulnerability

Please submit vulnerability reports through one of the following channels:

Email: securitycontact@vistrax.com
Reporting: Online form
Software Bill of Materials: Online spec (SBOM)
security.txt: https://vistrax.com/.well-known/security.txt

Where possible, please include:

• The affected product, model, software version or system;
• The type and technical description of the vulnerability;
• Prerequisites and potential impact;
• Reproducible steps;
• Proof-of-concept material, logs, screenshots or sample code;
• Details of any testing already performed;
• Possible remediation measures;
• The name or alias you would like us to use in any acknowledgement;
• Contact details for follow-up questions.

Please do not submit unnecessary personal data, credentials, private keys or complete datasets. Particularly sensitive information should be encrypted.

4. Responsible Security Research

We ask reporters to act in good faith and, in particular, to:

• Limit testing to what is necessary to demonstrate the vulnerability;
• Avoid disrupting operations or system availability;
• Refrain from modifying, deleting, downloading or disclosing data unless strictly necessary to demonstrate the vulnerability;
• Stop accessing data or systems once the vulnerability has been demonstrated;
• Refrain from establishing persistent access;
• Refrain from using malware;
• Refrain from obtaining credentials through phishing or other forms of social engineering;
• Not exploit a vulnerability for personal or third-party gain;
• Not disclose vulnerability details to third parties or the public without prior coordination with us;
• Comply with all applicable laws.

This policy does not constitute general authorization to access systems or data belonging to another party.

5. Our Handling Process

Vulnerabilities are addressed in accordance with the vulnerability management process. Actual or suspected security incidents are addressed in accordance with the incident response process.

After receiving a report, we aim to follow this process:

• All incoming reports are reviewed immediately and logged in the ticket system.
• Acknowledgement: within 5 business days.
• Initial assessment: within 10 business days.
• Prioritization: based on exploitability, severity, impact and the distribution of the affected product.
• Coordination: reasonable updates regarding material progress, where possible and appropriate.
• Remediation: development and testing of a security update or other appropriate measures.
• Coordinated disclosure: publication after remediation is available and affected users have had a reasonable opportunity to apply it.

Actual handling times depend on complexity, risk and dependencies involving suppliers or open-source projects. Critical and actively exploited vulnerabilities receive priority.

We may share a report with relevant suppliers, service providers, coordinators or competent authorities where necessary for investigation, remediation, coordination or compliance with legal obligations. We will limit the information shared to what is necessary for those purposes.

6. Coordinated Disclosure

Please allow us sufficient time to investigate and implement appropriate measures before publishing vulnerability details. As a general framework, we aim for coordinated disclosure within 90 days after confirming the vulnerability.

This period may be adjusted by mutual agreement, particularly where:

• Remediation is especially complex;
• Multiple vendors or open-source projects are affected;
• Earlier disclosure is necessary to protect users;
• Disclosure would create a disproportionate security risk.

The timing, scope and content of any publication should, where possible, be agreed between the parties. Information about a remediated vulnerability may include the affected product and versions, its impact and severity, and available security updates or mitigation measures.

7. Good-Faith Research

If you act in good faith and comply with this policy, CONZE will generally not initiate or support legal action against you solely on the basis of your security research. This does not apply to intentional damage, extortion, misuse of data, disproportionate interference, clearly criminal intent or other violations of applicable law. This statement cannot bind public authorities or third parties and does not constitute legal advice or a comprehensive waiver of liability.

If you are uncertain, please contact us before carrying out a potentially critical test.

8. Confidentiality and Data Protection

We generally treat vulnerability reports as confidential. Personal data will be processed only to the extent necessary for communication, investigation, documentation, remediation or compliance with legal obligations. We will publish a reporter’s identity or contact information only with their express consent, unless disclosure is legally required. Further information is available in our privacy policy.

Anonymous reports are accepted. However, our ability to ask questions and provide status updates may be limited if no contact channel is provided.

9. Recognition and Compensation

At the reporter’s request, we may acknowledge their contribution by name or alias after successful remediation. This policy is not a bug-bounty programme and does not constitute an offer of compensation. No payment or other consideration is due unless expressly agreed in writing in advance.

10. Abuse Reports and Support Requests

This contact point is intended exclusively for vulnerabilities affecting our products and digital services. For general support requests, fraud reports, privacy enquiries or security incidents unrelated to a product vulnerability, please use the contact form.

11. Policy Updates

We review this policy periodically and may update it to reflect technical, organizational or legal developments. The current version will be published on this page.

12. Privacy Policy Status

The last change was made on 08/01/2026.