Vulnerability Disclosure Policy

Last updated: 19 August 2026

We build access-control and time-&-attendance software. Security problems in our products put real doors, real workplaces and real people’s data at risk, so we want to hear about them — directly, and before anyone else does.

This policy tells you how to report a vulnerability to us and what you can expect in return.

Scope

This policy covers:

  • iTraze — the iTraze platform, in all supported versions, whether deployed on-premises or as SaaS
  • idManager — the device service and its supported integrations
  • Our infrastructure — itraze.com, itraze.cloud and the services we operate under those domains

If you are unsure whether something is in scope, report it anyway — we would rather triage a duplicate than miss a real issue.

How to report

Email security@daemez.com.

Please include, as far as you can:

  • A description of the vulnerability and where it exists (product, version, URL or component)
  • Steps to reproduce it — a proof of concept, script or screenshots help us fix it faster
  • The impact you believe it has
  • How you would like to be credited, if at all

Please report in English or Spanish.

What we commit to

  • Acknowledgement of your report within 3 business days
  • Triage and an initial assessment within 10 business days, including our view of severity and whether we can reproduce it
  • Progress updates while we work on a fix, and notice when the fix ships
  • Credit in our release notes or advisories, if you want it — or full anonymity, if you prefer

We handle actively exploited vulnerabilities and severe incidents under the reporting obligations of the EU Cyber Resilience Act, including notification to the competent authorities where required.

Safe harbour

We will not take legal action against you, nor report you to law enforcement, for security research conducted in good faith and in line with this policy. That means:

  • You make a genuine effort to avoid harming users, data, systems or service availability
  • You do not access, modify or exfiltrate more data than strictly necessary to demonstrate the issue
  • You do not exploit the vulnerability beyond that demonstration
  • You give us a reasonable opportunity to fix the issue before disclosing it publicly

This policy is aligned with coordinated vulnerability disclosure practice under the EU Cyber Resilience Act and NIS 2. It is not a bug bounty programme; we do not offer monetary rewards.

Out of scope

  • Denial-of-service testing of any kind
  • Social engineering, phishing or physical attacks against our staff, customers or premises
  • Vulnerabilities in third-party services we use but do not operate (report those to the third party)
  • Findings from automated scanners with no demonstrated impact

Coordinated disclosure

We ask for a standard disclosure window of 90 days from your report before public disclosure. If we need longer — for example, because a fix must be rolled out across customer installations — we will tell you why and agree a new date with you. If we consider the issue not to be a vulnerability, we will explain our reasoning, and you are free to publish after the window.