Product Security Incident Response Policy

Eqraft takes the security of its products seriously. If you believe you've found a security vulnerability in one of our products, or you're dealing with a security incident, we want to hear from you so we can investigate and respond.

Scope

This policy applies to all Eqraft products - whole production lines, individual machines, and the components inside them.

How to Report

Eqraft's product security team is your single point of contact for vulnerabilities and incidents. In line with Article 13(17) of the EU Cyber Resilience Act (Regulation (EU) 2024/2847), you're free to choose whichever of the following channels suits you best - you are not limited to an automated form:

Email: security@eqraft.com
Phone: +31 527 256 135

If your report contains sensitive information, we recommend encrypting it with our PGP key before sending.

Reporting a vulnerability

Please include:

  • the affected product model(s) and version(s), or date(s) of purchase;

  • the vulnerability type and a clear description;

  • steps to reproduce and/or the exploitation method;

  • a suggested remediation or mitigation, if you have one; and

  • any supporting material (logs, videos, screenshots, etc.).

Reporting a security incident

Please include:

  • a detailed description of what you've observed;

  • the affected product(s);

  • when it happened; and

  • any other relevant details.

We aim to acknowledge every report promptly and will keep you informed as we investigate.

What happens after you report

  1. Acknowledge - your report is logged and acknowledged.

  2. Assess - we determine whether it concerns an Eqraft product and represents a genuine vulnerability or incident. We may contact you if we need more information.

  3. Investigate & remediate - once confirmed, we begin work on a fix, whether that's a software update, configuration change, or other corrective measure.

  4. Coordinate - where appropriate, we coordinate with you on remediation and disclosure timing.

  5. Disclose & close - once the issue is resolved and any necessary communication is complete, we close the report. Where warranted, we publish a security advisory covering the affected products and versions, the impact, severity, available mitigations or updates, and any applicable vulnerability identifier.

Safe Harbor

We will not pursue legal action against anyone who reports a vulnerability or incident in good faith, provided they:

  • follow this policy;

  • avoid unnecessary disruption; and

  • do not access, modify, or disclose data belonging to others.

Coordinated Vulnerability Disclosure

Eqraft follows the principle of Coordinated Vulnerability Disclosure (CVD): when a researcher or other reporter discovers a vulnerability in an Eqraft product, we work with them to investigate and remediate it before any details are made public. This gives us the time needed to protect our customers, while giving reporters confidence that their findings are taken seriously.

Security Advisories

Eqraft publishes security advisories for vulnerabilities affecting its products to any known contacts with said products. Customers will always have the option to opt out of these emails.

Policy Updates

We review this policy periodically and may update it as our products, processes, or applicable regulations change.