Security Policy
Last updated 2026-09-25

At Farsight, we develop our software solutions with security as a core foundation. We are committed to protecting our customers and maintaining the integrity of our products. This policy outlines how security researchers, customers, and partners can report security vulnerabilities to us, what we promise in return, and our commitments under European security frameworks.

1. Reporting a vulnerability

If you believe you have discovered a security vulnerability in a Farsight solution or on our web infrastructure, please report it to us privately.

  • Contact Channel: Please email security@farsight.se
  • Languages Supported: We accept reports in English and Swedish.
  • Information to Include: To help us triage your report quickly, please include the product name, version or URL, a brief description of the issue, and step-by-step instructions or proof-of-concept code to reproduce the vulnerability.

If you need to share highly sensitive files or data, please contact us first so we can establish a secure, encrypted communication channel.

2. Our commitments and remediation SLAs

When you report a valid vulnerability to Farsight, you can expect the following operational response:

  • Acknowledgment: We will acknowledge receipt of your report within 3 business days.
  • Validation & Updates: We will validate the flaw and keep you informed of our remediation progress at reasonable intervals.
  • Remediation Timelines: We aim to remediate confirmed vulnerabilities based on their CVSS severity rankings:
    • Critical Severity: Targeted resolution within 14 days.
    • High Severity: Targeted resolution within 30 days.
    • Medium & Low Severity: Targeted resolution in the next scheduled product release or within 90 days.

3. Safe harbour

Farsight will not pursue or support legal action against security researchers who act in good faith and adhere to this policy. To remain in safe harbor, we ask that you:

  • Give us a reasonable opportunity to investigate and release a fix before disclosing any details publicly.
  • Avoid privacy violations, unauthorized data access, modification, or destruction of production data.
  • Do not execute volumetric denial-of-service (DDoS) testing, social engineering attacks against our staff, or physical security breaches.

4. Scope

This policy applies exclusively to products and digital assets owned and maintained by Farsight.

  • In Scope:
    • Proprietary software solutions distributed directly by Farsight.
    • The primary corporate web domain: farsight.se and its immediate subdomains.
  • Out of Scope:
    • Third-party platforms, external SaaS tools, or cloud infrastructure hosting our services (vulnerabilities found in these components should be reported directly to their respective vendors).
    • Automated scanner outputs that do not demonstrate a functional, exploitable impact.

5. Regulatory compliance & CRA mandates

In compliance with Article 14 of the EU Cyber Resilience Act (Regulation (EU) 2024/2847), Farsight maintains an active internal process to handle product security. Separately from our customer notification workflows, we actively fulfill our legal obligation to report any actively exploited product vulnerabilities or severe security incidents directly to the Swedish national CSIRT (CERT-SE) via the EU Single Reporting Platform within the statutory 24-hour early-warning window.

 

Security

security@farsight.se

 

Hej!

Du lämnar vår hemsida!

Oroa dig inte, detta öppnas i en ny flik så att du enkelt kan återvända till den här sidan.
Avbryt
Okej, fortsätt