Security

Isonoe d.o.o. makes the GaiaPulse monitoring devices (Sentinel and Fractis) and the cloud service they report to. If you think you found a security weakness in them, email [email protected].

Please include the product and, if you know it, the firmware version; what you found and how to reproduce it; and how to reach you. Plain email is the only channel at present: we publish no encryption key, so do not send secrets you can avoid sending.

We acknowledge your report within 5 working days, tell you whether we consider it a vulnerability, and keep you informed at least every 30 days until it is resolved.

We fix confirmed vulnerabilities as quickly as we can and publish an advisory when a fix is available, crediting you if you wish. Please give us reasonable time to fix the problem before you publish details, and tell us if you plan to; we will agree a date with you.

Where the law requires us to report an actively exploited vulnerability or a severe incident to the authorities (Regulation (EU) 2024/2847, Article 14), we do so within its deadlines; your report may be part of that.

The GaiaPulse Sentinel and Fractis devices (firmware, NFC interface, mobile-network link) and the backend service they connect to.

If you act in good faith, report to us, and avoid privacy violations, data destruction and disruption of other customers' devices or services, we will not take legal action against you for the research. Do not test on units that are not yours, and do not access or keep data that is not yours.

Advisories for each product are listed on the product's security page (GaiaPulse: gaiapulse.eu/security). Each GaiaPulse product receives security updates for at least 5 years from the day it is first placed on the market.

This policy is also published as security.txt.