Compliance
How we keep Phonos, Alef and this website secure: where to report a vulnerability, what we publish, how long each product gets security updates, and where we stand on the EU Cyber Resilience Act.
Report a vulnerability
Found a security problem in one of our products? Tell us here or write to [email protected] with the subject SECURITY. We confirm every report within three working days.
How we handle reports
- Confirmation
- within 3 working days, with a reference number
- First assessment
- within 10 working days: valid or not, and how severe
- Fix
- critical and high issues as fast as possible, aim 30 days; security fixes ship separately from features where possible and are free of charge
- Disclosure
- coordinated with you, normally 90 days after your report, as an advisory on this page
- Safe harbour
- no legal action against good-faith research that stays within your own accounts and data and does not degrade our services
- Machine-readable
- security.txt (RFC 9116, also at /.well-known/security.txt)
Security advisories
Fixed vulnerabilities, with severity, affected and fixed versions.
No security advisories have been published.
Support periods
How long each product receives security updates. Software services you use in the browser are kept up to date for as long as they are online; software products you download and run receive security updates for five years from release.
| Product | Version | Security updates |
|---|---|---|
| Software services (web): Phonos, Alef | ||
| Phonos web platform | hosted | For as long as the service is accessible via the web, at no charge. |
| Alef order portal | hosted | For as long as the service is accessible via the web, at no charge. |
| Software products (downloadable) | ||
| Gimel | – | Five years from its release as a downloadable product; the end date is published with each release. Gimel is not yet released as a download. |
| phonos-sdk | 1.x | At least five years from the release of a version; the end date is published with each release. |
| phonos-cli | 1.x | At least five years from the release of a version; the end date is published with each release. |
| Phonos worker images | – | At least five years from the release of an image; the end date is published with each image. |
For customers: your information and options
What you can do yourself today, and where. Everything listed here already exists in our products.
| You want to | Phonos | Alef |
|---|---|---|
| Get security updates | Nothing to do: the hosted service is updated for you. For phonos-sdk and phonos-cli, install the latest release. | Nothing to do: the hosted portal is updated for you. |
| Protect your account | Sign-in code by email; manage it under Settings. | Authenticator app with recovery codes, open sessions and sign-in address under Security. |
| Take your data with you | Account data export (JSON) in Settings; project files can be downloaded from each project. | Every saved shape as DXF under My forms; invoices under Invoices. |
| Close your account | Delete the account in Settings; statutory retention (e.g. invoices) still applies. | Close the account under Security; statutory retention still applies. |
| Control cookies and analytics | Cookie settings in Phonos; analytics only with your consent. | Optional history only with your consent; no analytics in the portal. |
| Follow an order | – | With order number and email under Track an order, also without an account. |
| Get early access | Apply to the Trusted Tester Program. | – |
| Ask about your data or our components | Write to [email protected]: access, correction, deletion or objection under the GDPR, or information about the components in our software (software bill of materials). | |
| Report a vulnerability | Form on this page | |
EU Cyber Resilience Act
Regulation (EU) 2024/2847 sets security rules for products with digital elements. Reporting duties apply since 11 September 2026, everything else from 11 December 2027.
- Manufacturer
- FyreFly Systems GbR, Bergstraße 16, 06366 Köthen (Anhalt), Germany
- Hosted services
- Phonos, Alef and this website run on our infrastructure and are used through the browser. We apply the same security and update rules to them.
- Software you run
- phonos-sdk, phonos-cli and the Phonos worker images are products under the CRA once we distribute them, with the Phonos backend as their remote data processing. Each release names its version, support end date and a software bill of materials.
- Incident reporting
- Actively exploited vulnerabilities and severe incidents are reported to the CSIRT through the ENISA Single Reporting Platform within 24 hours (early warning) and 72 hours (notification), and affected users are informed.
- Conformity
- Default product category, internal control (module A). The EU declaration of conformity will be published here before 11 December 2027.