Product Cybersecurity
E2M COUTH
Incident reporting, security advisories, and resources for E2M COUTH products.
No customer account required.Contact information is optional.
This channel covers E2M COUTH products during their support period. Malfunctions without cybersecurity implications are handled through the Technical Support Service (SAT).
Information on published incidents, affected products and versions, mitigation measures, and available solutions.
The absence of advisories does not imply that the products are free of vulnerabilities. Published advisories will detail the scope of the problem and the available measures.
Each report is reviewed to determine its scope and the necessary actions. The case file and its evidence are managed with restricted access.
We log the report, assign it a reference number, and retain the information received.
We analyze the facts, the products involved, and the potential impact to determine the priority for action.
We investigate the cause and determine the appropriate corrective or mitigating measures.
We verify the effectiveness of the measures and document the outcome before closing the case.
We coordinate relevant communications and use the findings to improve product safety.
Communications to users, third parties, or authorities are evaluated upon receipt and may be issued before the technical investigation is complete.
This policy establishes the scope of the channel and the conditions for reporting potential cybersecurity issues and coordinating the disclosure of vulnerabilities.
Report an incidentPotential vulnerabilities, product incidents, design or testing findings, configuration weaknesses, issues with third-party components, and other security compliance violations related to products from E2M COUTH may be reported.
The report may include the product or component, its version, a description of the problem, the context, the date of observation, the detected effects, and any available technical references. Attachments must be relevant and limited to the necessary information.
A CVE reference, severity score, or proof of concept is not required. The absence of a model or version number does not prevent the submission of the report.
When a contact method is provided, the responsible team may request clarifications and coordinate the exchange of information and any subsequent disclosure. Receipt of a report does not confirm the existence of a vulnerability nor does it imply that its content will be published.
Reports will be logged and reviewed by the Product Cybersecurity team. Contact information will be used exclusively for case management. The priority, appropriate actions, and necessary communications will be determined by authorized personnel.
Security information organized by product, model, and version.
Information on security releases, application requirements, operational precautions, and installation verification.
BY PRODUCTDocumentation for the secure installation, configuration, operation, and maintenance of the product.
APPROVED DOCUMENTATIONScope of security support and end date applicable to each product or version.
PRODUCT INFORMATIONDescribe the potential problem and provide any available information. It is not necessary to know the cause or confirm a vulnerability: analysis is the responsibility of the Product Cybersecurity team.
Devices, hardware, firmware, software, embedded systems, and components from E2M COUTH.
You may report the incident anonymously. Without a means of contact, we will not be able to request clarification or directly follow up on the case.
Information regarding the processing of personal data through this form, including attachments and communications related to the incident.
This notice governs the processing of personal data provided through the channel established to report potential vulnerabilities, incidents, findings, configuration weaknesses, or other cybersecurity incidents related to products from E2M COUTH.
E2M COUTH VISION SYSTEMS, S.L.U., Pau Vilà i Dinàrès, 10, 08192 Sant Quirze del Vallès, Barcelona, Spain.
The data will be processed to receive and log the report; contact the reporter when they voluntarily provide contact information; analyze, reproduce, evaluate, and classify the issue; determine affected products and versions; examine attached files provided as evidence; perform technical security checks, validation, and quarantine on such files; investigate the cause; define and verify measures; coordinate communications and disclosure; comply with legal obligations; preserve evidence; and improve the security of products and processes.
The data and attachments will not be used for advertising, marketing, newsletters, or commercial profiling.
Technical data regarding the incident, product, versions, context, impact, dates, evidence, and references may be processed, as well as name or alias, email address, organization, relationship to the product, and language when voluntarily provided.
When the upload feature is used, attachments and their technical metadata may also be processed, including the original filename, file extension, declared and detected file type, size, date received, integrity hash, and the results of security checks. The content and metadata of the files may include personal data belonging to the reporter or third parties; therefore, only data that is strictly necessary and duly authorized should be attached.
The service may generate technical logs necessary for its security and traceability.
The processing is based on the data controller’s legitimate interest in protecting its products and users and, where applicable, on compliance with legal obligations. The investigation of the incident is not based on consent.
The reporter may report the issue without providing a name, company, or email address. In that case, it will not be possible to request clarifications or directly coordinate follow-up. This option alone does not guarantee absolute technical anonymity.
Access will be limited to individuals and departments that need to know the information. Strictly necessary information may be disclosed to suppliers, component manufacturers, distributors, consultants, CSIRTs, authorities, ENISA, or other agencies as appropriate.
Attachments may be processed by vendors providing hosting, secure storage, antimalware analysis, quarantine, logging, or technical support services, acting in accordance with applicable contractual and security safeguards.
The information and attachments will be retained for as long as necessary to investigate, address, verify, and close the incident and, subsequently, for the period necessary to document the handling of the incident, address liabilities, fulfill obligations, maintain traceability, and identify recurrences. Identifying data will be deleted or anonymized when it is no longer necessary.
Rejected, blocked, or quarantined files and their technical logs will be retained only for the period defined by the applicable security policy and will be deleted when they are no longer necessary.
International transfers will be made only when necessary or when required by technology providers involved in the processing, storage, or analysis of files, email, or ticketing, in accordance with the safeguards required by regulations.
Automated rules may be used to generate alerts or facilitate initial prioritization. Severity assessment, processing, disclosure, and regulatory decisions will be carried out by authorized personnel.
Technical and organizational measures will be implemented to protect information against loss, alteration, unauthorized access, or disclosure. Attachments may be validated, renamed, stored outside the public directory, quarantined, and subjected to security checks before being accessed by the responsible team.
Passwords, private keys, credentials, or personal or confidential information that is not strictly necessary must not be submitted.
Data subjects may exercise their rights through the channels indicated in the privacy policy of the responsible company and file a complaint with the Spanish Data Protection Agency.
Incident reporting
Allows you to provide product information, describe the incident, and attach supporting files in a structured manner.
Report an incidentAlternative channel
Point of contact for cybersecurity incidents involving products from E2M COUTH.
In the event of an immediate risk to people, facilities, or production, follow your facility’s procedures and avoid any actions that could aggravate the situation.
Frequently asked questions
No. This channel is open to customers, users, distributors, suppliers, researchers, and others who have information about a potential product cybersecurity issue.
Yes. Provide the available information and select “I don’t know” where applicable. A version number, CVE reference, or proof of concept is not required to submit a report.
No. The case file and its evidence are managed with restricted access. Any public announcement requires review and approval; receipt of a report does not guarantee its publication.
Yes. You are not required to provide your name, organization, or email address. Without a means of contact, we will not be able to request clarifications or maintain direct communication. This option does not guarantee absolute technical anonymity.
You may submit screenshots, logs, and other files necessary for analysis, within the formats and limits specified in the form. Credentials, private keys, and unnecessary data must be excluded. Files may undergo security checks prior to review. If they cannot be attached, the report may be submitted without them; if contact information is provided, a secure channel can be arranged for their exchange.
