Thermia Vulnerability Disclosure Policy

Introduction  

Thermia is committed to ensuring the security of our users by protecting their data and information. This policy gives security researchers clear guidelines for conducting vulnerability discovery activities related to our products and services, and conveys our preferences in how to submit discovered vulnerabilities to us.  

This policy describes which Thermia products and services are covered by this policy, our guidelines for security researchers, our vulnerability reporting process, and our practices for coordinated public disclosure. 

We encourage you to contact us to report potential vulnerabilities in our products and services. 

Authorization  

If you comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the vulnerability quickly, and we will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known. 

Guidelines 

When conducting vulnerability discovery activities related to our products and services you must adhere to the following guidelines: 

Once you’ve established that a vulnerability exists or encounter any sensitive data (e.g. personal data, financial information, or proprietary information or trade secrets of any party), you must stop your activity, notify us immediately, and not disclose this data to anyone else. 

Unauthorized activities 

The following activities are not authorized: 

Scope 

This policy applies to the following Thermia products and services: 

Products or service not expressly listed above are excluded from the scope of this policy and are not authorized for testing or other vulnerability discovery activities. The same applies to underlying infrastructure or systems from our vendors. Before targeting any vendor’s infrastructure or systems, you should ensure that your planned activities comply with vendor's own vulnerability discovery policy. Vulnerabilities discovered in vendor's infrastructure or systems must be reported directly to the vendor. Thermia assumes no liability whatsoever for your activities involving vendor infrastructure or systems. If you aren’t sure whether a system is in scope or not, contact us at security@thermia.com before starting your activities. 

Though we develop and maintain other internet-accessible products or services, we ask that your activities only be conducted on the systems and services covered by the scope of this policy. If there is a particular product or service not in scope that you think merits testing, please contact us to discuss it first. We will increase the scope of this policy over time.  

Reporting a vulnerability 

We accept vulnerability reports via security@thermia.com. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. We do not support PGP-encrypted emails. 

What we would like to see from you 

In order to help us triage and prioritize submissions, we recommend that your reports: 

What you can expect from us 

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible. 

Coordinated vulnerability disclosure 

Our vulnerability disclosure process is aligned with cybersecurity legislation. We will process submitted vulnerability reports in accordance with all applicable law, including mandatory notification obligations.  

Personal data 

If your share personal data in your submission (e.g. your e-mail address or name), we will process that data as described in our Privacy Policy.