Security and Vulnerability Disclosure

1. How to report a vulnerability

Write to security@embediot.es. You can write in English, Spanish or Catalan. To help us analyse it quickly, please include as far as possible:

• The affected product or service and its version (for example, the system version shown in the gateway interface).
• A description of the vulnerability and its potential impact.
• The steps needed to reproduce it and, if available, a proof of concept.
• How we can contact you and whether you would like to be credited in the acknowledgements.

Do not include personal data of third parties in your message, nor any information obtained beyond what is strictly necessary to demonstrate the issue.

2. Scope

This policy applies to:

• The LONTRA gateway (device, operating system, application and its update service).
• The online services associated with the gateway (decoders.embediot.es and the update registry).
• This website (embediot.es).

Third-party products and services (for example, Home Assistant or LoRaWAN sensors from other manufacturers) are out of scope; in that case, please contact their manufacturer directly.

3. What you can expect from us

• Acknowledgement of receipt within 3 working days at most.
• Initial assessment (confirmation and severity) within 10 working days at most.
• Updates on the progress of the fix until it is released.
• A fix and a security update released as soon as possible according to severity, with a target of 90 days at most.
• Coordinated disclosure with you and, if you wish, credit in the acknowledgements.

4. Guidelines for responsible research

We ask you to:

• Only test devices you own or for which you have the owner's express authorisation.
• Not access, modify or delete other people's data, and not go beyond what is necessary to demonstrate the vulnerability.
• Not carry out denial-of-service attacks, social engineering or physical tests on our premises.
• Not make the vulnerability public until the fix has been released or 90 days have passed since your report, unless agreed with us.

If you act in good faith and follow these guidelines, we will not take legal action against you for your research.

5. Security updates and support

Security fixes for the gateway are distributed through its update service, digitally signed by Embed-IoT. The device notifies you in its interface when a new version is available and automatically applies the security patches for its operating system.

Embed-IoT provides security updates for the LONTRA gateway for at least 5 years from the date each unit is placed on the market. The end-of-support date of your device (month and year) is shown on its packaging and in the user manual.

When a vulnerability is being actively exploited or a severe incident occurs, we will notify the competent authorities in accordance with European cybersecurity regulations and inform the affected users of the measures they should take.

6. Contact

Security reports: security@embediot.es
Other enquiries: info@embediot.es
Machine-readable information: /.well-known/security.txt

This is a translation for information purposes. In case of discrepancy, the Spanish version prevails.