Cybersecurity

We recommend providing a contact method when reporting a security vulnerability so that we can request additional information if necessary and keep you informed about the progress of the investigation.

If you prefer not to provide any personal information, we will only process the information you voluntarily submit. Please note that investigating such reports may be more challenging if additional technical information or clarification is required.

Information can be submitted to us using the contact channels specified in the policy. Electronic communication is protected by established technical security measures designed to safeguard data transmission. If you have specific confidentiality requirements, please contact us so that we can jointly agree on an appropriate method of transmission.

We aim to provide a personal acknowledgement of receipt within five business days and an initial assessment or qualified feedback within ten business days.

Our feedback may include confirmation of the reported vulnerability, requests for additional information, or an update on the status of our investigation.

We welcome reports relating to vulnerabilities that affect:

• HYFRA products
• Digital services provided by HYFRA
• HYFRA IT infrastructure
• The confidentiality, integrity, availability, or authenticity of our systems and services

To help us investigate efficiently, reports should include sufficient technical information and, where possible, relate to previously undisclosed vulnerabilities.

To support efficient investigation and remediation, we recommend including:

• the affected product, system, service or website
• a description of the vulnerability
• the potential impact
• steps required to reproduce the issue
• supporting evidence such as screenshots, log files or proof-of-concept material

The more detailed the information provided, the faster the reported vulnerability can be assessed and addressed.

We ask all reporting parties to act responsibly and in good faith.

When conducting security research, please:

• Avoid disrupting our services or business operations
• Do not access, modify, delete, or disclose data that is not your own
• Refrain from social engineering, denial-of-service, brute-force, or similar attacks
• Keep discovered vulnerabilities confidential until remediation and coordinated disclosure have been completed
• Communicate respectfully and professionally throughout the process

We appreciate responsible disclosure and welcome constructive collaboration that helps us improve the security of our products and services.

Confirmed vulnerabilities are assessed, prioritized, and addressed through our vulnerability management process.

Where appropriate, HYFRA will provide corrective actions, software updates, mitigation measures, or security advisories. We may also inform affected customers, partners, and other relevant stakeholders.

Any public disclosure of confirmed vulnerabilities will be coordinated in accordance with responsible vulnerability disclosure practices to ensure customer protection and system security.