External Cybersecurity Standard & Reporting Procedures

At cellumation, we are dedicated to ensuring the security, reliability, and integrity of our modular conveyor systems (celluveyor), our software solutions, and our digital infrastructures. We deeply appreciate the vital role that security researchers, customers, and the wider cybersecurity community play in keeping systems safe.

If you believe you have discovered a security vulnerability in one of our products, services, or web presences, we encourage you to report it to us as soon as possible. We are committed to collaborating with you to resolve the issue swiftly and responsibly.

1. Scope

This policy applies to all digital assets, products, and services owned or operated by cellumation GmbH, including:

• Web Presences: The cellumation.com domain and all associated subdomains.
• Product Software (celluveyor): Software components, firmware, and cloud interfaces running on or controlling our modular conveyor systems (including cv.SINGULATE, cv.CROSSDOCK, cv.DEPAL/cv.PAL, cv.GO, and cmile.SORT).
• APIs and Services: Publicly accessible APIs, customer portals, and integration services provided by cellumation.

2. How to Report a Vulnerability

Please submit your findings as soon as possible to our dedicated security inbox:

To help us triage and remediate the issue quickly, please provide as much of the following info:

• Target: The specific URL, IP address, product name, firmware, or software version affected.
• Vulnerability Type: A brief description of the vulnerability (e.g., SQL Injection, Remote Code Execution, Privilege Escalation).
• Steps to Reproduce: Clear, step-by-step instructions, proof-of-concept (PoC) code, or screenshots demonstrating the exploit.
• Potential Impact: An assessment of the severity and how a malicious actor could exploit the vulnerability.
• Disclosure Intent: Whether you plan to publish these findings and your proposed timeline.

3. Rules for Responsible Security Research

We welcome security research conducted in good faith. To ensure your research remains safe, constructive, and legal, you must adhere to the following guidelines:

• No Harm or Disruption: Do not perform testing that causes system downtime, degradation, or disruption of service (e.g., Denial of Service / DDoS attacks).
• Data Privacy: Do not access, modify, download, or delete customer data, transaction records, or any personal information. If you accidentally gain access to sensitive or third-party data, cease testing immediately, delete local copies, and notify us.
• No Social Engineering: Do not target cellumation employees, contractors, or customers with phishing, social engineering, or physical security attacks.
• Prioritize Non-Production: When possible, conduct tests against test accounts, local deployments, or simulated environments rather than live production networks.
• Confidentiality: Keep all details of the vulnerability confidential until we have co-developed and deployed a resolution.

4. Our Commitment to You

If you comply with this policy and act in good faith, we commit to the following response framework:

• Acknowledge: We will acknowledge receipt of your report within 3 business days.
• Evaluate: We will conduct an initial risk assessment and triage within 10 business days and keep you informed of our progress. Reports indicating active exploitation or a potentially severe security incident are subject to immediate escalation and are not governed by the standard 10-business-day triage timeline.
• Remediate: We will work to resolve verified vulnerabilities in a timely, risk-based manner, depending on the severity and complexity of the issue.
• No Legal Action (Safe Harbor): If you comply with this policy and act in good faith, cellumation will not initiate legal action or criminal complaints against you regarding your research.
• Recognition: With your explicit consent, we are happy to attribute and publicly thank you for your contribution to our security once the vulnerability has been patched.

5. European Cyber Resilience Act (CRA) Compliance

As a manufacturer of products with digital elements, cellumation closely adheres to the reporting and management obligations defined by the European Union’s Cyber Resilience Act (CRA). If cellumation becomes aware of an actively exploited vulnerability contained in a product with digital elements, or of a severe incident having an impact on the security of such a product, cellumation will initiate its regulatory reporting workflow in parallel with our internal Incident Response Procedures:

• 24-Hour Early Warning: An early warning notification will be submitted to the European Union Agency for Cybersecurity (ENISA) and the competent national CSIRT (e.g., BSI in Germany) through the ENISA reporting platform without undue delay and in any event within 24 hours of becoming aware of an actively exploited vulnerability.
• 72-Hour Detailed Notification: A report detailing the vulnerability, its initial impact, and mitigation strategies considering all available information will be submitted within 72 hours.
• Remediation & Closure: A formal update and final report will be submitted within 14 days (severe incident: 1 month), detailing the permanent patches or workarounds deployed.