Flowgy security: reporting vulnerabilities
At FLOWGY, S.L. we treat the security of our software as part of patient safety. If you have found a potential vulnerability in Flowgy, please report it to us through this channel before making it public.
How to report it
Write to seguridad@flowgy.com and include:
- the affected product and version;
- a description of the vulnerability and the steps to reproduce it;
- the scope or effect you have observed;
- how you would like us to contact you.
Do not include patient data or any other personal information about third parties. We do not need it to analyse the issue and we will not accept it.
What we will do
| Step | Commitment |
|---|---|
| Acknowledgement | Within 5 working days, with a tracking reference |
| Analysis | We assess whether the vulnerability affects the product in its actual configuration and inform you of the result |
| Fix | Where applicable, we tell you when a fix is expected and notify you when it is available |
| Publication | We publish a security advisory identifying the fixed version |
Coordinated disclosure
We ask you not to disclose the vulnerability until a fix is available or until 90 days have passed since our acknowledgement, whichever comes first. If you wish, we will credit you publicly in the security advisory.
Good faith
We will not take action against anyone who, acting in good faith, reports a vulnerability to us under this policy, does not access patient or third-party data, does not degrade the service and does not exploit the vulnerability beyond what is necessary to demonstrate it.
Urgent situations
If you believe the vulnerability is being exploited or may affect a clinical result, write URGENT in the subject line: it will be handled immediately, outside the ordinary process.
FLOWGY, S.L. · Tax ID (CIF) B06981963 · Parque Tecnológico de Fuente Álamo, Ctra. RM-E14 Lobosillo–Estrecho, km 2 · 30320 Fuente Álamo de Murcia (Murcia), Spain
Policy in force since:
