VULNERABILITY HANDLING AND DISCLOSURE POLICY

Versione / Versión / Version 2026-10-26.1 · In vigore dal / Vigente desde / Effective from 2026-10-26

1. Scope. This policy covers the software products of INFOKRAUSE S.R.L. con Socio Unico, tax code and VAT no. 04126260928 («INFOKRAUSE»): IKFace (Edge and Server), IKCount, IKVisitor, their modules, the Customer Portal and the partner portals. It implements Regulation (EU) 2024/2847 (Cyber Resilience Act).

2. How to report. Send reports to security@infokrause.com stating: product and version, description and impact, steps to reproduce, any proof of concept and a contact. Reports are accepted in Italian, Spanish or English. Do not include third-party personal data beyond what is strictly necessary.

3. Our commitments. INFOKRAUSE acknowledges receipt within 5 business days, assesses the report, informs the reporter of the outcome and expected timeline and fixes confirmed vulnerabilities without undue delay, prioritising those actively exploited or of high severity. With the reporter's consent, it credits them publicly in the security advisory.

4. Coordinated disclosure. We ask that the vulnerability not be disclosed until a fix is available or, at the latest, 90 days after the report, unless otherwise agreed. After the fix, INFOKRAUSE publishes a security advisory with affected products and versions, severity and the measures to take.

5. Good-faith research. INFOKRAUSE will not take legal action against anyone who, in good faith: tests only on their own installations or the demo; does not access, modify or retain customer or third-party data beyond the minimum needed to demonstrate the issue and deletes it immediately; does not disrupt services (no denial of service, spam or social engineering); and reports promptly respecting point 4. This policy does not authorise testing customer installations, which belong to the customers.

6. Security updates and customers. Fixes are distributed as updates through the Customer Portal at ikface.net, separate from feature updates where possible, and remain available for the support period set out in the EULA (clause 10). INFOKRAUSE informs affected customers and, through distributors, the customers they serve, of actively exploited vulnerabilities and severe incidents and of the measures to take.

7. Notifications to authorities. Under Art. 14 of Regulation (EU) 2024/2847, INFOKRAUSE notifies actively exploited vulnerabilities and severe incidents affecting the security of its products through ENISA's single reporting platform, to the CSIRT of its main establishment (Italy).

8. Contact. security@infokrause.com (security) · info@infokrause.com (other enquiries). INFOKRAUSE may update this policy; the current version is published at ikface.net. The text is drafted in Italian, Spanish and English; the Italian text prevails.