Technical Product Security & Vulnerability Reporting Policy

In compliance with European Union cybersecurity standards and Regulation (EU) 2024/2847 (Cyber Resilience Act), AISS maintains a dedicated framework to ensure the continuous security and resilience of our cloud-based digital signage platform and integrated media players.
This policy outlines the official channel and procedure for reporting suspected security vulnerabilities or technical compliance issues related to AISS hardware, firmware, or software products.

1. Official Reporting Channel

If you detect or suspect a security vulnerability in the AISS client application, operating system layer, or cloud platform, you must submit a formal notification directly to our security management team at the office@aiss.hu e-mail address.

2. Required Information for Submission

To ensure immediate triage and processing under EU regulatory timelines, all submissions should contain the following objective technical data:

  • Component Identification: The specific software version, media player hardware model, or platform URL involved.
  • Technical Description: A clear explanation of the suspected vulnerability or security anomaly.
  • Reproduction Steps: Objective technical steps, logs, or proof-of-concept indicators required to verify the issue.
3. Regulatory Triage & Remediation Process

Upon receipt of a technical report through our official channel, AISS executes the following mandated procedures:

  • Acknowledgment: AISS will formally acknowledge receipt of the report within 3 business days.
  • Validation: Our engineering department will analyze and verify the technical validity of the submission.
  • Mandatory Disclosure Evaluation: If the vulnerability is determined to be actively exploited or poses a severe security risk, AISS will initiate mandatory notification protocols to the European Union Agency for Cybersecurity (ENISA) and competent national authorities within the legally prescribed windows.
  • Remediation: Validated issues will be mitigated through system updates or security patches deployed via our remote update infrastructure based on severity level.