Coordinated Vulnerability Disclosure (CVD) Policy

Our Commitment

Portwell values vulnerability reports from independent security researchers, customers, partners, and other stakeholders. We follow Coordinated Vulnerability Disclosure (CVD) principles and handle reported or suspected vulnerabilities responsibly and transparently, with customer risk reduction as our priority. We aim to work constructively with reporters, assess the affected scope, plan remediation or mitigation, and coordinate public disclosure at the appropriate time.

Cybersecurity Governance and Regulatory Resilience

Portwell obtained IEC 62443-4-1 certification in 2026 and continues to integrate secure development lifecycle practices, product vulnerability management, and supply-chain coordination into product cybersecurity governance. Where applicable, our disclosure and reporting activities are aligned with requirements under the EU Cyber Resilience Act (CRA), including appropriate assessment and coordination for actively exploited vulnerabilities, severe cybersecurity incidents, and related corrective measures. This policy is not limited to the CRA: Portwell also seeks to meet or support other applicable product cybersecurity, cyber-resilience, privacy, notification, and customer-contract requirements.

Scope

This policy applies to standard Portwell products, supported firmware and software, Portwell-operated services, and official websites within their support lifecycle. Portwell will address custom products, end-of-life products, and third-party components to the extent it can reasonably control remediation or coordination; obligations for custom products remain subject to the applicable agreement. This policy does not replace product documentation, warranty terms, service agreements, or legal obligations.

Vulnerability Reporting

To report a suspected vulnerability, you can submit your findings using email or our secure online form.