Vardion's position
Regulation (EU) 2024/2847 (the Cyber Resilience Act, CRA) applies to products with digital elements made available on the EU market. As software a customer installs on its own server, Vardion is such a product. Kartia IKE is its manufacturer. The reporting obligations of Article 14 apply from 11 September 2026 and the manufacturer's other obligations from 11 December 2027.
The hosted console is a service Vardion provides, governed by the service agreement and the data processing agreement.
Support period
Vardion is released on a single release line. Each release carries a version number and a fingerprint of the code that runs, shown at the foot of the console's menu. Security fixes are released on that line as soon as they are ready and applied to the hosted console when they are released. An installation on a customer's own server receives them by updating to the latest release.
Vardion's support period is five years from the release of each version, as Article 13(8) of the Regulation asks. During that period every vulnerability that affects a version is fixed in the current release, to which every supported installation can update.
Reporting a vulnerability
Report a vulnerability in Vardion to support@getvardion.com. The same address is published in security.txt. Include the version and fingerprint your console shows, the steps to reproduce it and the impact you saw.
How we handle a vulnerability
- We confirm that we received the report and assess it.
- We fix the vulnerability, add a check that catches it if it returns and release the fix.
- We tell the reporter and the affected customers, with the steps to update.
- We report every actively exploited vulnerability and every severe incident to the CSIRT and ENISA within the deadlines of Article 14.
- We take no legal action against anyone who reports a vulnerability in good faith and harms no data or system.
Software bill of materials (SBOM)
Vardion's software bill of materials is available on request at support@getvardion.com. The open-source tools the Docker image contains, with their versions and licences, are also listed on the console's licences page. Scanner binaries are fixed at build time: each download is checked against a hash recorded in the source code. The nuclei templates are fetched at scan time.
Contact
For this statement: support@getvardion.com.