Vardion's position
Regulation (EU) 2024/2847 (the Cyber Resilience Act, CRA) applies to products with digital elements made available on the EU market. As software a customer installs on its own server, Vardion is such a product. Kartia IKE is its manufacturer. The reporting obligations of Article 14 apply from 11 September 2026 and the manufacturer's other obligations from 11 December 2027.
The hosted console is a service Vardion provides, governed by the service agreement and the data processing agreement.
Support period
Vardion is released on a single release line. Each release carries a version number and a fingerprint of the code that runs, shown at the foot of the console's menu. Security fixes are released on that line as soon as they are ready and applied to the hosted console when they are released. An installation on a customer's own server receives them by updating to the latest release.
Vardion's support period is five years from the release of each version, as Article 13(8) of the Regulation asks. During that period every vulnerability that affects a version is fixed in the current release, to which every supported installation can update.
Reporting a vulnerability
Report a vulnerability in Vardion to security@getvardion.com. The same address is published in security.txt. Include the version and fingerprint your console shows, the steps to reproduce it and the impact you saw.
How we handle a vulnerability
- We acknowledge each vulnerability report within 2 working days.
- We assess and fix the vulnerability, add a check that catches it if it returns and release the fix.
- We tell the reporter and the affected customers, with the steps to update.
- We report every actively exploited vulnerability and every severe incident at the same time to the CSIRT designated as coordinator and to ENISA, through the single reporting platform (Article 14(1) and (3)).
- We take no legal action against anyone who reports a vulnerability in good faith and harms no data or system.
The deadlines of Article 14
| What we report | Early warning | Notification | Final report | Provision |
|---|---|---|---|---|
| An actively exploited vulnerability | Within 24 hours of becoming aware of it | Within 72 hours | No later than 14 days after a corrective or mitigating measure is available | Article 14(2) |
| A severe incident affecting Vardion's security | Within 24 hours of becoming aware of it | Within 72 hours | Within one month of the incident notification | Article 14(4) |
Software bill of materials (SBOM)
Vardion's software bill of materials is available on request at support@getvardion.com. The open-source tools the Docker image contains, with their versions and licences, are also listed on the console's licences page. Scanner binaries are fixed at build time: each download is checked against a hash recorded in the source code. The nuclei templates are a reviewed set, fixed in each release; nothing fetches them at scan time.
Contact
For this statement: support@getvardion.com.