At IRM360, we take the security of our systems very seriously. Despite our efforts to ensure the security of our systems, vulnerabilities may still occur. If you have discovered a vulnerability in one of our systems, we would appreciate hearing from you so that we can take action as quickly as possible. We would like to work with you to better protect our customers and our systems. To this end, IRM360 has established a Coordinated Vulnerability Disclosure policy. The Coordinated Vulnerability Disclosure (CVD) ensures that vulnerabilities can be reported and resolved in a timely and secure manner, thereby minimizing risks to users and our organization.
This policy describes the process for responsibly reporting and addressing vulnerabilities in our products, services, and systems
This CVD policy applies to the following products, services, and systems:
The following are not included:
IRM360 does not process reports regarding third parties and software that are not directly related to our software, or reports concerning trivial vulnerabilities or security issues that cannot be exploited. While these issues should also be resolved, CVD reports specifically concern vulnerabilities that require immediate resolution.
Vulnerabilities can be reported using the CVD reporting form
When submitting a report, please provide the following information:
We aim to send a confirmation of receipt within 48 hours.
Upon receiving a report, our security team will review it and launch an investigation. The reporter will receive updates on the status of the investigation, typically within a week.
Our internal teams will work together to mitigate the vulnerability and roll out patches as needed.
The disclosure of the vulnerability is coordinated with the reporter to ensure timely and responsible communication. We respect embargoes and strive for joint disclosure whenever possible.
We expect reporters to:
Our organization will:
While we value ethical hacking within the scope of our services, we do not accept liability for any damage resulting from negligent behavior. We assume no liability for any damage that may occur during the testing process, provided that actions are taken within the scope and in accordance with ethical guidelines.
Deventer, August 2025
IRM360 BV