ZAPP, S.L. · Version 1 · 12 November 2026
ZAPP welcomes reports of vulnerabilities found in its products and services. This policy follows ISO/IEC 29147 and the EU Cyber Resilience Act (Regulation (EU) 2024/2847).
Scope
- The Ecaldima platform and its WebBase core, both SaaS and on-premise.
- The MyZapp portal and ZAPP's websites.
Out of scope: denial-of-service testing, social engineering, physical access, and any testing of our hosting providers' infrastructure or of other customers' instances.
How to report a vulnerability
Email security@zappsl.com with a description of the vulnerability, the steps to reproduce it, the affected version and its impact. Do not include third parties' personal data.
Our commitments
| Step | Timeframe |
|---|---|
| Acknowledgement | 3 business days |
| Initial assessment and severity | 10 business days |
| Fix for a critical vulnerability | 7 days |
| Fix for other vulnerabilities | 30 days |
| Security advisory | After the fix, agreed with the reporter |
We keep you informed of progress and credit you in the advisory if you wish.
Rules for researchers
- Act in good faith: access no more data than needed to demonstrate the vulnerability, and do not modify or keep it.
- Do not disclose the vulnerability before it is fixed or, at the latest, before 90 days from your report, unless otherwise agreed.
- Test only against your own account or instance.
ZAPP will not take legal action against anyone who follows these rules.
Advisories and updates
We publish our security advisories in the Security advisories category on MyZapp and notify affected on-premise customers directly. Security updates are provided free of charge throughout each version's support period.