Product security

This page explains how to report a vulnerability in the Ordivis Platform, how we handle it, and which information we provide under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It applies to every component of the Ordivis Platform: server, Windows client, collector, wallboard, web portal, Android app and Ordivis Toolbox.

Reporting a vulnerability

Report vulnerabilities to security@ordivis.eu. This is the only reporting channel we designate. Please do not use the contact form, and do not publish your findings while a remedy is outstanding.

The following helps us:

• the affected component and its version, for example "Server 2026.8.16.645"
• a description that makes the fault reproducible
• the impact you expect
• your contact details, if we may come back to you

What you can expect from us

• acknowledgement of receipt within three working days
• an initial technical assessment within ten working days
• an update on the status at least every fourteen days
• credit as the finder on request, once the remedy is published

Grams IT is a micro-enterprise. We do not pay bounties for reports. We say so plainly rather than raising an expectation we cannot meet.

Our commitment to reporters

Anyone who investigates a vulnerability in good faith and reports it to us has no legal action to fear from us. This commitment applies as long as you

• do not access, alter or delete third-party data,
• do not impair availability, in particular do not mount denial-of-service attacks,
• test only your own installations, or those for which the operator has given you permission,
• keep your findings confidential until a remedy is available, and
• comply with applicable law.

Coordinated disclosure

We ask you to treat a reported vulnerability as confidential for ninety days, or until a remedy is available, whichever comes first. If a remedy takes longer, we will agree the approach with you. We publish fixed vulnerabilities with a description, a severity rating and the remedy.

If a vulnerability is actively exploited, from 11 September 2026 Article 14 of the Cyber Resilience Act obliges us to report it within twenty-four hours to the competent computer security incident response team and to the European Union Agency for Cybersecurity. This obligation applies regardless of any arrangement with you; we will inform you about it.

Information under Annex II of the Cyber Resilience Act

The obligations under the regulation apply in full from 11 December 2027. We provide the following information already, because our customers — public administration, municipalities and operators of critical facilities — need it for their own procurement.

Manufacturer
Grams IT, Christian Grams, Mittelstraße 18, 34277 Fuldabrück, Germany.
General address: info@ordivis.eu

Contact point for vulnerabilities
security@ordivis.eu. Our coordinated vulnerability disclosure policy is set out on this page. In machine-readable form it can be found at /.well-known/security.txt.

Product
Ordivis Platform. The version follows the pattern year.month.day.time and is shown in the application under "About" and in the file properties of every delivered file.

Intended purpose and security environment
Ordivis Platform is an application for IT service management, configuration management and IT asset management. It runs on the customer's network, not on ours. It is intended to run on a managed corporate network behind a firewall, on a maintained Windows server with PostgreSQL, reachable over an encrypted connection.

Essential security properties

• role-based and attribute-based permission checks, separated for reading and writing
• multi-factor authentication; directory services are connected in read-only mode
• tenant separation at database level
• audit-proof change log
• transport encryption with TLS 1.2 and 1.3, exclusively using forward-secrecy suites
• locally stored secrets are protected using the operating system's own facilities
• updates are delivered signed and verified before installation

Known circumstances that may lead to significant risks
The regulation requires such circumstances to be named. We do so completely, including where it is uncomfortable.

• As delivered, the server expects encryption to be terminated upstream, for example by a reverse proxy. If it is operated without one, credentials travel across the network unencrypted. The operating modes with your own certificate or with automatic certificate retrieval are available and are described in the documentation.
• Discovery stores credentials for network devices, which are frequently privileged. Anyone who gains access to the Ordivis server indirectly gains access to that data. Assign dedicated accounts with the least sufficient permissions for discovery.
• Ordivis holds a complete picture of your IT landscape. Unauthorised read access is therefore a reconnaissance gain for an attacker, even without any ability to write.
• Securing the operating system, the database and the backups is the operator's responsibility. Ordivis cannot compensate for an insecure environment.

Support period
Until 31 December 2032 inclusive. Until that date we handle vulnerabilities and provide security updates free of charge. The period applies to every version of the Ordivis Platform delivered up to that point.

Security updates
Updates are provided through the application's update service and transmitted signed. You can switch off automatic installation in the settings and install updates manually; the notification about an available update remains in place. How to install updates, what effect a change has on your data, and how to decommission an installation securely and remove data without residue is described in the documentation.

Software bill of materials for third-party components
Every installation package includes a machine-readable bill of materials in CycloneDX 1.6 format: ordivis-sbom.cdx.json in the program directory. Alongside it you will find THIRD-PARTY-NOTICES.txt with copyright notices and licence texts.

EU declaration of conformity
Not yet available. The conformity assessment under the Cyber Resilience Act is due by 11 December 2027; the declaration will be published here at that time. Until then the Ordivis Platform does not carry a CE marking for cybersecurity.

Status

This information relates to the Ordivis Platform in the version delivered at the time. As at 16 August 2026.