Solius Commitment to Product Cybersecurity
DRAFT: brief description about the SOLIUS Labs’s cybersecurity program.
Protecting user safety, data integrity, and system reliability is a core priority at SOLIUS Labs. Our cybersecurity program uses a risk-based approach aligned with recognized industry standards and regulatory guidance to safeguard our medical devices and digital systems throughout their lifecycle. Cybersecurity is integrated from product design through post-market support, including security testing, ongoing monitoring, and timely mitigation of potential vulnerabilities. We support responsible vulnerability disclosure and continuously enhance our security controls and processes to address evolving cyber threats.
Solius Coordinated Vulnerability Disclosure Process
At SOLIUS Labs, we develop technologies to advance and optimize the health of our users. To achieve this, we uphold core values that define our responsibility to those we serve. Among them is an unwavering commitment to the safety and security of users. Therefore, we believe in continuously improving how we address the evolving privacy and cybersecurity landscape. In response to potential threats to cybersecurity, SOLIUS Labs has formed a global product security team to assess vulnerabilities and determine responses within a coordinated vulnerability disclosure (“CVD”) process. These efforts allow us to continually learn from vulnerability information submitted to us by customers and security researchers. We reserve the right to modify our CVD at any time, without notice, and to make exceptions to it on a case-by-case basis. No particular level of response is guaranteed. However, if a vulnerability is verified, we will attribute recognition to the researcher reporting it, if requested by the Reporter.
Scope
This CVD process applies to the reporting of potential cybersecurity vulnerabilities in SOLIUS Labs’s products and services. For customer support help requests, technical documents, and regulatory contacts and notifications, please contact Support.
Contact Information
Potential security vulnerabilities or privacy issues with any of our products or services should be reported to: support@solius.com
Avoiding Potential Harm
When conducting your security research, please avoid actions that could cause harm to patients or products. Vulnerability testing could negatively impact a product. As such, testing should not be conducted on active products in a clinical setting, and products subjected to security testing should not subsequently be used in a clinical setting.
Adhere to the laws of your location and the location of SOLIUS Labs and refrain from disclosing vulnerability details to the public before a mutually agreed-upon timeframe expires.
Submission Process
As part of the information sent to us, we request that as much of the following information, as possible, be included:
Your contact information (e.g., name, address, phone number, and email)
Date and method of discovery
Description of potential vulnerability
Product name
Version number
Configuration details
Steps to reproduce
Tools and methods
Exploitation code
Privileges required
Results or impact
Do you want public credit for discovering this vulnerability?
We ask that you please refrain from including sensitive information such as:
Sample information
Personal Health Information
Personally Identifiable Information
Financial Information (e.g. credit card or bank account numbers)
Proprietary information or trade secrets of any involved company
Next Steps
Upon receipt of a potential product vulnerability submission, we will:
Acknowledge receipt of the submission within five (5) business days
Work with our specialized product teams to evaluate and validate reported findings
Contact the Reporter to request additional information, if needed
Take appropriate action(s)
We will inform the Reporter of the conclusion of this process and any action(s) we have taken.
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, will work with you to understand and resolve the issue quickly, and will not initiate or recommend legal action related to your research.