certified 2026
IEC 62443-4-1
Secure product development lifecycle certification.
product security & vulnerability management
Product Security at Portwell
At Portwell, product security is an important part of building reliable computing solutions. We take potential cybersecurity vulnerabilities seriously and are committed to handling reports responsibly throughout the product support lifecycle.
We encourage customers, partners and security researchers to report potential vulnerabilities so they can be assessed and addressed in a coordinated manner.
our approach to responsible disclosure
Coordinated Vulnerability Disclosure (CVD)
Portwell values vulnerability reports from independent security researchers, customers, partners and other stakeholders. We follow CVD principles and handle reported or suspected vulnerabilities responsibly and transparently, with customer risk reduction as our priority.
We aim to work constructively with reporters, assess the affected scope, plan remediation or mitigation, and coordinate public disclosure at the appropriate time — in alignment with our IEC 62443-4-1 certification and the EU Cyber Resilience Act (CRA).
our disclosure principles
01
Responsible Handling
We review vulnerability reports carefully and assess their potential impact on affected products and users.
02
Coordinated Communication
We encourage reporters to coordinate disclosure with Portwell to help ensure that relevant risks can be assessed and appropriate information shared.
03
Lifecycle Awareness
Product security considerations may extend beyond initial product delivery. The handling of vulnerabilities and availability of corrective measures depend on the affected product and its support status.
full cvd policy
Last updated: September 2026Cybersecurity Governance and Regulatory Resilience
Portwell obtained IEC 62443-4-1 certification in 2026 and continues to integrate secure development lifecycle practices, product vulnerability management and supply-chain coordination into product cybersecurity governance.
Where applicable, our disclosure and reporting activities are aligned with the EU Cyber Resilience Act (CRA), including assessment and coordination for actively exploited vulnerabilities, severe cybersecurity incidents and related corrective measures. This policy is not limited to the CRA: Portwell also seeks to meet or support other applicable product cybersecurity, cyber-resilience, privacy, notification and customer-contract requirements.
Scope
This policy applies to standard Portwell products, supported firmware and software, Portwell-operated services and official websites within their support lifecycle.
Portwell will address custom products, end-of-life products and third-party components to the extent it can reasonably control remediation or coordination; obligations for custom products remain subject to the applicable agreement. This policy does not replace product documentation, warranty terms, service agreements or legal obligations.
Product Security Incident Response Team (PSIRT)
The PSIRT is Portwell’s dedicated function for receiving and managing product security incidents and vulnerability reports, including intake, technical validation, risk assessment, remediation coordination and related disclosure activities.
Where a reported vulnerability involves third-party software, firmware, hardware components, open-source software or external suppliers, Portwell may coordinate remediation, mitigation and disclosure with the relevant suppliers, maintainers or other affected stakeholders.
Good-Faith Research and Safe Harbor
Portwell will treat good-faith research as authorized when it follows this policy, is intended to identify and reduce cybersecurity risk, and is promptly reported. Portwell will not initiate legal action against security researchers solely because they conduct vulnerability research in good faith and in compliance with this policy.
This commitment does not cover denial-of-service, destructive or availability-impacting testing, social engineering, phishing, physical intrusion, credential theft, malware, persistence, broad scanning, brute force, or any activity that violates applicable law.
Privacy, Confidentiality and Reservations
Portwell uses report information only for intake, validation, risk assessment, remediation, supply-chain coordination, security improvement and applicable legal compliance. We will not disclose a reporter’s identity or non-public technical details unless necessary to handle the vulnerability, comply with a legal obligation, or with appropriate consent.
This policy is not a bug-bounty program and does not guarantee compensation, acknowledgement, a particular remediation method or a completion date. Portwell may update this policy as regulations, products or the threat landscape evolve.
help us improve product security
Report a Potential Security Vulnerability
If you believe you have identified a cybersecurity vulnerability affecting a Portwell product, supported software or firmware, a Portwell-operated service or an official Portwell website, please report it to the Portwell Product Security Incident Response Team (PSIRT).
Providing clear technical details helps us understand the issue, assess its potential impact and determine appropriate next steps. Choose the reporting channel that fits your report.
reporting channels
option 01 · for sensitive attachments
Secure Email
If your report includes highly sensitive supporting evidence such as detailed logs or proof-of-concept code, we strongly recommend PGP-encrypted email.
- PSIRT email
- psirt@portwell.com.tw
- Suggested subject
- [CVD Report] (Product name) / (Model name)
option 02 · structured submission
Online Submission Form
Submit your findings directly using our secure online form. It includes all fields needed to assess your report efficiently.
- Reporter information
- Affected product details
- Vulnerability technical details
- Supporting evidence & consent
information to include
Please include the following information where available. This list is a guide and does not limit the submission of other information that may help us assess your report.
01
Reporter Contact
Name, organization and email address.
02
Affected Product
Product name, model, hardware revision and firmware or software version.
03
Technical Description
Expected and actual behavior, known or potential impact and affected security properties.
04
Reproduction Steps
Required equipment, software, configuration, network environment and sequence of actions.
05
Supporting Evidence
Proof-of-concept material, screenshots, logs, packet captures or non-malicious test code.
06
Potential Exploitation
How an attacker could exploit the issue, prerequisites and potential attack path.
07
Additional Context
Any information that may clarify scope, impact or remediation options.
[cvd] psirt vulnerability reporting form
Submit a Vulnerability Report
after you submit
Our Vulnerability Management Process
Timelines are adjusted according to risk, reproducibility, affected scope, exploitability and case complexity. Unless a statutory obligation applies, they are operational targets rather than guarantees for individual cases.
01
Initial Response
The PSIRT records the submission, acknowledges receipt, establishes a communication channel and explains next steps.
- target: 2 business days
02
Assessment & Classification
Reproducibility and risk are evaluated. Each accepted report receives a unique tracking identifier.
- target: 24 h after sufficient info
03
Investigation & Notification
Root cause, affected scope and exploitation conditions are investigated; regulatory notification is assessed.
- target: 72 h
04
Remediation & Validation
Software, firmware, configuration or other corrective measures are developed, tested and validated.
- risk-prioritized
05
Coordinated Disclosure
A disclosure timeline is coordinated and confirmed vulnerabilities may be published as a Security Advisory.
- agreed with reporter
Where the EU Cyber Resilience Act applies and an actively exploited vulnerability is confirmed, Portwell issues an early warning no later than 24 hours, a notification no later than 72 hours after awareness, and a final report no later than 14 days after a corrective or mitigating measure becomes available.
security information & updates
Product Security Advisories
Confirmed product cybersecurity vulnerabilities may be communicated publicly through a Security Advisory on the Portwell website.
Advisories may include the vulnerability description, affected products and versions, risk information, available mitigations or security updates, and revision history.
need assistance?
We’re Here to Help
If you have questions about a Portwell product, need technical support or require further information about a published security advisory, our teams can help direct your inquiry to the appropriate contact.
faq
Product Security Questions
What types of issues can I report?
You can report suspected cybersecurity vulnerabilities affecting Portwell products, supported software or firmware, Portwell-operated services and official Portwell websites. Please provide enough technical detail for the issue to be assessed.
How should I send sensitive information?
If your report contains sensitive evidence such as detailed logs or proof-of-concept code, please encrypt it with the Portwell PSIRT PGP public key and send it by email. Include only the personal data needed to process the report.
Should I disclose a vulnerability publicly before contacting Portwell?
We encourage responsible, coordinated disclosure. Please contact Portwell before publicly sharing technical details of a suspected vulnerability so that the issue can be assessed and potential risks considered.
How quickly will Portwell respond?
Our target is to acknowledge a report within two business days. Timelines for assessment, investigation and remediation depend on risk, reproducibility, affected scope and case complexity.
Will Portwell provide a fix for every reported vulnerability?
Not every report will necessarily result in a software update or other corrective measure. The appropriate response depends on the assessment, potential impact, technical feasibility and the affected product’s support status.
Does Portwell offer a bug bounty?
No. Our CVD policy is not a bug-bounty program and does not guarantee compensation or acknowledgement.
Have a Product Security Question?
To report a suspected vulnerability or ask about our CVD policy, contact the Portwell PSIRT. For product-related questions, our technical support team is here to help.