Coordinated Vulnerability Disclosure Policy

Wed, 09 Sep 2026 00:00:00 +0000

Document Classification: Public

1. Purpose

Catalogic Software (“Catalogic,” “we,” “our”) values the contribution of independent security researchers and members of the public who help us find and fix security vulnerabilities in our products. This policy explains how to report a suspected vulnerability in Catalogic DPX or Catalogic CloudCasa, what you can expect from us in response, and the terms under which we authorize good-faith security research.

This policy also reflects Catalogic’s obligation, as a manufacturer of “products with digital elements” under the EU Cyber Resilience Act (Regulation (EU) 2024/2847, the “CRA”), to maintain and enforce a coordinated vulnerability disclosure process (CRA Annex I, Part II(5)) and to publish a single point of contact for vulnerability reports (CRA Annex II(2)).

Security on Catalogic Software

Coordinated Vulnerability Disclosure Policy

1. Purpose