SAFETY

Report a Security Vulnerability

iDM takes IT security seriously. If you discover a security vulnerability in our products, website, or digital services, or if you are a customer or partner and would like to report a security-related incident, please contact us using the address below.

CONTACT

Our Central Reporting Office

If you have discovered a security vulnerability in an iDM product, our website, or a digital service, please notify us using the following contact address.

team@idm-energie.at

Read More

For security reports, you can contact us directly by email.

Confidentiality

We treat all security reports confidentially and will inform you of the next steps once our review has been completed.

Coordinated Vulnerability Disclosure

Unsere CVD-Policy

iDM has established a Coordinated Vulnerability Disclosure (CVD) policy for handling reported security vulnerabilities.

Scope
This policy applies to all iDM products and digital systems, in particular our heat pump control systems and the myIDM Cloud.

How to Report a Vulnerability
Please contact us at team@idm-energie.at. The same address is also available in machine-readable format in our security.txt file at /.well-known/security.txt.

We kindly ask you not to publicly disclose the vulnerability (e.g. on blogs, social media, or forums) until it has been resolved. This gives us sufficient time to develop and implement a solution before the vulnerability can be exploited.

What Your Report Should Include

  • The affected product or system
  • A description of the vulnerability and its potential impact
  • Steps to reproduce the vulnerability, if possible
  • Contact details so that we can reach you if we have any questions

Safe Harbor

If you report a vulnerability in good faith and in accordance with this policy, we will not initiate legal action against you as a result of your report, provided that you:

  • do not access, modify, or extract data beyond what is necessary to demonstrate the vulnerability,
  • do not access third-party systems or data,
  • do not impair the availability of our systems (no DDoS attacks),
  • keep the vulnerability confidential until the agreed disclosure date.

Information for Security Researchers

iDM supports the responsible and coordinated disclosure of security vulnerabilities. For technical security reports, please use the contact address provided above.

Security.txt

Technical information for automated security queries can be found at:

/.well-known/security.txt