1. Purpose
The security of our software and the protection of our customers are of the utmost importance to us. K-iS Systemhaus GmbH takes reports of potential security vulnerabilities in steadyPRINT seriously and, with this Coordinated Vulnerability Disclosure Policy (CVD Policy), provides a centralized process for reporting and coordinating the handling of vulnerabilities. This policy describes how security vulnerabilities can be reported and how we handle incoming reports.

2. Scope
This policy applies to security vulnerabilities in the steadyPRINT software product, which is developed and provided by K-iS Systemhaus GmbH. Non-security-related bugs, general product questions, and support requests are not covered by this policy and should be reported through the regular support channels.

3. Reporting a Security Vulnerability
If you have discovered a potential security vulnerability in steadyPRINT, please report it to us using one of the following methods:

• Email: security@steadyprint.com
• Security contact form: https://www.steadyprint.com/kontakt/#security

To help us investigate and evaluate the report as quickly as possible, it should include the following information, if available:

• Affected steadyPRINT version and component,
• Description of the suspected vulnerability,
• Steps to reproduce the issue,
• Potential impact of the vulnerability,
• Available technical evidence, logs, or screenshots,
• Where applicable, references to existing or planned publications,
• Contact information for inquiries

Please do not submit any personal data, login credentials, or other confidential information unless it is necessary for analyzing the vulnerability.

4. Editing a Report

Upon receipt of a vulnerability report, K-iS Systemhaus GmbH reviews it and assesses its potential impact on the security of steadyPRINT. Regardless of the procedures described in this policy, we immediately review every incoming report to determine whether it triggers any legal reporting obligations to the relevant authorities—particularly in cases where there are indications of active exploitation of the reported vulnerability or a serious security incident. We fulfill these legal reporting obligations independently of our handling of the report and communication with the person who submitted it. We strive to promptly acknowledge receipt of a report and to maintain appropriate communication with the reporter throughout the investigation. The processing time depends in particular on the complexity, severity, and potential impact of the reported vulnerability. If a vulnerability is confirmed, we will take appropriate measures to remedy it or mitigate its impact. Necessary security updates and information will be provided in accordance with our processes.

5. Coordinated Disclosure

We ask reporters not to disclose information about a potential vulnerability publicly before we have had the opportunity to investigate the report and—if necessary—provide appropriate measures to fix the issue or mitigate the risk.
Where possible, any public disclosure should be coordinated with K-iS Systemhaus GmbH. The goal of this coordinated approach is to reduce the risk of the vulnerability being exploited and to give steadyPRINT users sufficient time to implement the necessary security measures or updates.

6. Security Updates and Information

We provide security updates for supported steadyPRINT versions to our customers free of charge. These updates are accompanied by corresponding notifications containing the necessary information about the resolved vulnerability and are made available through our existing product and support channels.

The support period for steadyPRINT is at least five years from the initial release of the respective major version on the market. Security updates and minor versions within a major version are covered by that major version’s support period and do not constitute a separate support period of their own.

7. Kontakt

Responsible manufacturer
K-iS Systemhaus GmbH
Sonnenstraße 33-35
57078 Siegen
Germany
Security contact: security@steadyprint.com
Security contact form: https://www.steadyprint.com/kontakt/#security
These contact options serve as a central point of contact for reporting security vulnerabilities in steadyPRINT.

8. Updates to This Policy
This Coordinated Vulnerability Disclosure Policy may be amended if technical, organizational, or legal requirements change. The version currently published on the steadyPRINT website is the one that applies.
As of: September 2026