Statement

Cybersecurity and compliance statement

FyreFly Systems GbR · Version 1.0 · 13 October 2026

1. Issuer

Company: FyreFly Systems GbR
Address: Bergstraße 16, 06366 Köthen (Anhalt), Germany
VAT ID: DE370197687
Security contact: [email protected] (subject SECURITY)
Representation: Impressum

2. Scope

This statement covers the software FyreFly Systems provides.

Product	How it is provided	Under the EU Cyber Resilience Act
Phonos web platform	Hosted service, used in the browser	Remote data processing of the Phonos software below
phonos-sdk, phonos-cli	Software you install and run	Products with digital elements, once distributed
Phonos worker images	Software you run on your hardware	Products with digital elements, once distributed
Alef order portal	Hosted service, used in the browser	Service; we apply the same security rules
fyreflysystems.de	Information website	Not a product; same security rules

3. Our commitments

Security updates: Software services accessible via the web (Phonos, Alef): free of charge for as long as the service is accessible. Downloadable software products (Gimel once it is released as a download, phonos-sdk, phonos-cli, Phonos worker images): free of charge for five years from each release, released separately from feature updates where technically possible.
Vulnerability handling: Coordinated disclosure: confirmation within 3 working days, first assessment within 10, critical and high issues fixed as fast as possible (aim 30 days), public advisory after the fix.
Incident reporting: Actively exploited vulnerabilities and severe incidents reported through the ENISA Single Reporting Platform within 24 hours (early warning) and 72 hours (notification); affected customers informed without undue delay.
Components: Third-party and open-source components are checked before use and tracked for vulnerabilities; each release of software you run comes with a software bill of materials.
Data protection: Personal data is processed under the GDPR as described in the privacy policies of the website, Phonos and Alef.

4. Current status

Regulation (EU) 2024/2847: reporting duties apply since 11 September 2026, all other obligations from 11 December 2027.

Requirement	Status
Security contact and disclosure policy	In place: compliance page, security.txt, Impressum
Vulnerability report intake and advisories	In place
Incident reporting process	In place for the reporting duties that apply now
Support periods	Published on the compliance page
Software bill of materials, technical documentation	In preparation
EU declaration of conformity and CE marking	Before 11 December 2027 (default category, internal control, module A)

5. Note

This statement describes our commitments and where we stand. It is not an EU declaration of conformity under Article 28 of Regulation (EU) 2024/2847 and does not change the terms of service, order terms or privacy policies, which take precedence. We update it when our status changes; the version and date are at the top.