EN DE
Sign Up

Vulnerability Disclosure Policy

(Deutsche Version) Version: 10 October 2026

Security is at the core of what we build. If you believe you have found a security vulnerability in an XplicitTrust product or service, we want to hear about it. This policy explains how to report it, what you can expect from us, and the rules for good-faith security research.

Scope

This policy covers:

  • the XplicitTrust apps and agents for Windows, macOS, Linux, iOS and Android, and our software packages and repositories;

  • the XplicitTrust console, APIs and the cloud services that the apps connect to (for example console.xplicittrust.com);

  • our websites under xplicittrust.com.

Vulnerabilities in third-party products or services that we use should be reported to their vendor. If such a vulnerability affects XplicitTrust, please tell us as well.

The following are out of scope: denial-of-service and load testing, social engineering and phishing of our staff or customers, physical attacks, spam, and findings without a demonstrable security impact (for example missing security headers on pages without sensitive content, or version banners).

How to report

Send your report by email to security@xplicittrust.com. Please encrypt sensitive details with our PGP key: security-contact.asc (fingerprint F1D7 803E 064A A971 6B49 E85E 1856 85AA CB53 8032). Our security.txt lists the same contact. If you cannot use email, contact us through the postal address or phone number in our imprint. We accept reports in English and German.

A good report contains:

  • the affected product, component and version (or URL);

  • a description of the vulnerability and its impact;

  • the steps to reproduce it, ideally with a proof of concept;

  • how we can reach you, and whether and how you would like to be credited.

What you can expect from us

  • Acknowledgement of your report within 3 business days.

  • An initial assessment (confirmed or not, severity) within 10 business days.

  • Status updates at least every 14 days until the issue is resolved.

  • Fix targets from confirmation, based on CVSS severity: critical within 7 days, high within 30 days, medium within 90 days, low with a regular release. If we cannot meet a target, we tell you why and what we do in the meantime.

  • Credit in the security advisory, if you wish.

Security updates for our apps and agents are free of charge. We publish a security advisory for every fixed vulnerability that affects customers, with the affected versions, severity and the steps customers should take, and we request a CVE identifier where appropriate.

Coordinated disclosure

Please give us the chance to fix a vulnerability before you make it public. We agree the publication date with you; by default, details may be published once a fix is available or 90 days after your report, whichever comes first. If a vulnerability is being actively exploited, we may shorten this period together with you.

As a manufacturer under the EU Cyber Resilience Act, we must report actively exploited vulnerabilities in our products to the competent authorities (the CSIRT designated as coordinator, in Germany the BSI, and ENISA). If your report concerns such a vulnerability, we will tell you before we pass on information from it.

Safe harbour

We will not take legal action against you or file a criminal complaint for research that follows this policy, and we consider such research authorised. To stay within this policy, please:

  • use your own accounts (for example a free trial) and do not access, modify or delete data of other users beyond the minimum needed to demonstrate the issue;

  • stop and report immediately if you come across personal data or credentials, and do not keep or share them;

  • avoid degrading our services or those of our customers, and do not use automated scanning at a volume that could do so;

  • do not exploit a vulnerability further than necessary to confirm it, and do not use it to move into other systems;

  • keep the details confidential until the agreed publication date.

This safe harbour only covers XplicitTrust systems and products. We cannot give permission on behalf of third parties, such as our customers or service providers.

Your personal data

We use the contact details in your report only to handle the report and to credit you if you wish. Details are in our privacy notice.

Get the whitepaper Book a demo