PRODUCT SECURITY AND PSTI COMPLIANCE

We encourage you to report vulnerability information that can provide us with significant information that helps improve the security of products for customers. Before submission of a vulnerability report, please read this Vulnerability Disclosure Policy thoroughly and follow the process described in the following section (i.e., What to expect) in compliance with this policy. Please also note that we do not have a bug bounty program, so you cannot request monetary compensation based upon acknowledgment of the reported vulnerability.

Contact

If a vulnerability is discovered in our products, submit your vulnerability report using the reporting form below. However, if you do not wish to directly contact TA Triumph-Adler, we recommend submitting your report through the Coordination Centre in your country (i.e., CERT/CC) (*2).

Content

If possible, please submit your report containing the following detailed information:

• Reporter's name and contact information
• Name of the product that contains the potential vulnerability
• The product version that contains the potential vulnerability
• Type of the potential vulnerability (e.g., Information Disclosure, Privilege Escalation, Remote Code Execution, etc.)
• Impact of the potential vulnerability
• Steps in the specific and detailed process to reproduce the potential vulnerability
• The circumstance that an attacker requires to exploit the vulnerability
• Proof-of-concept code
• Public, third-party reports of vulnerabilities (i.e., references)
• Date when you have discovered the vulnerability
• Others, additional information

^{(*2) The Coordination Centre coordinates incident response related to stakeholders in your country in the event of an incident.}

After a vulnerability is reported to TA Triumph-Adler PSIRT, we acknowledge receipt of the vulnerability report. We handle the process according to the following phases:

Receipt

In the receipt phase, a vulnerability reporter receives acknowledgement within 3 of our working days. The next correspondence is determined upon completion of our initial investigation. We will keep you informed of our vulnerability analysis status.

Verification

In the verification phase, we need to confirm with the respective development divisions for any reported vulnerability. We investigate and analyze the phenomenon's effects when a vulnerability is exploited and the difficulty and conditions when a vulnerability is exploited. We ask that you provide us with a reasonable amount of time (at least 90 days from the acknowledgement) to resolve the issue before you disclose it publicly.

Remediation

In the remediation phase, the respective development divisions complete vulnerability analysis, such as the vulnerability's potential impact on our products, possible effects when the vulnerability is exploited, and the difficulty and conditions when a malicious attacker attempts to exploit the vulnerability and validate software remediation, mitigation, and workaround. Based upon the results, the timeline will be determined so we can take temporary and permanent security measures, respectively. If a vulnerability significantly impacts the global markets and takes time to remediate, alternative mitigation measures will be offered to customers. We will provide customers with adequate security measures as soon as possible and be as transparent as possible about the steps we take during the remediation process, including on issues or challenges that may delay resolution. We will communicate closely with the vulnerability reporter.

We are responsible for the appropriate disclosure of vulnerability information and extend the same responsibility to reporters. If TA Triumph-Adler PSIRT determines that the vulnerability information is critical to customers, like when there is a possibility of personal information leaks, we will publish security-related information (i.e., the advisory) on our security page of the TA Triumph-Adler (UK) Ltd company website . For any public release, please coordinate with TA Triumph-Adler PSIRT or Computer Emergency Response Team Coordination Center (CERT/CC) (in case you contact CERT/CC in your country). Note that we create the disclosure contents based on the coordination.

You must not:

• Violate laws/regulations/standards enacted in respective countries/regions.
• Share or re-distribute any data obtained through our products to third parties.
• Submit the report by using a product obtained improperly through a malicious person.
• Attempt to contact us utilizing vulnerable communication.
• Report any vulnerabilities related to Denial of Services (DoS or DDoS).
• Submit the report on products that are not brought in line with best practices.
• Submit the report on TLS configuration weaknesses e.g., TLS1.0 support.
• Use social engineering attacks.
• Demand monetary compensation to disclose any vulnerabilities

You must:

• Be compliant with all relevant laws/acts, standards, data protection, and privacy laws.
• Securely delete all data used during your vulnerability investigation/analysis/research as soon as it is no longer required (*3)

^{(*3) Reference: Article 17 General Data Protection Regulation (GDPR) Right to erasure ('right to be forgotten')}

TA Triumph-Adler UK does not claim any ownership rights to the information included in the reported Vulnerability Disclosure under this Policy, including, but not limited to, any data, text, material, program code, suggestion and recommendation received from the reporter (“Reported Vulnerability Information”).

By providing any Reported Vulnerability Information to UTAX (UK) Ltd, the reporter

• grants us the following non-exclusive, irrevocable, perpetual, royalty-free, worldwide, sub-licensable license to the intellectual property in the Reported Vulnerability Information:
• to use, review, assess, test, and otherwise analyse the Reported Vulnerability Information; and
• to reproduce, modify, distribute, display and perform publicly, and commercialize and create derivative works of the Reported Vulnerability Information and all its content, in whole or in part, for the purpose of fixing the reported vulnerabilities, improving Products, and marketing, sale and promotion of such improved Products;
• agrees to sign any documentation that may be required for us or our designees to confirm the rights the reporter granted above;
• understands and acknowledges that we may have developed or commissioned materials similar or identical to the Reported Vulnerability Information, and the reporter waives any claims or rights it may have resulting from any similarities to the Reported Vulnerability Information;
• understands and acknowledges that it is not guaranteed any compensation or credit for Reported Vulnerability Information; and
• represents and warrants that it hasn’t included any of personal data in Reported Vulnerability Information, it hasn't used any information or intellectual property owned by a third party in violation of legal or contractual requirements, and that the reporter has the legal right to provide the Reported Vulnerability Information to us subject to this Policy.