Security and vulnerability reporting

Ebeco wants our connected products, app and services to be secure for everyone who uses them. If you have discovered a vulnerability, we would like to hear from you. This policy explains how to report a vulnerability and what you can expect from us.

Scope of this policy

  • Connected products including EB-Therm 300, EB-Therm 500, Wallflex 500 and Wallflex 600, including their firmware.
  • The Ebeco Connect app for iOS and Android.
  • The cloud services supporting the app, e.g. api.ebecoconnect.com.

The following are not covered: third-party services that we do not operate, physical attacks against our premises, and social engineering of our employees.

How to report a vulnerability

Send your report to security@ebeco.com. You can write in Swedish or English.

Please include the product and version, a description of the vulnerability and its potential impact, instructions on how we can reproduce it, whether you have seen any indication that it is already being exploited, and how we can contact you.

You can report a vulnerability anonymously, but if you do, we will not be able to ask you any follow-up questions.

What we commit to

  • We will acknowledge receipt of your report within [3] working days.
  • We will provide an initial assessment within [10] working days.
  • We will keep you informed until the vulnerability has been resolved.
  • We will treat your report confidentially and only share it with authorities where required by law, and with suppliers who need the information to develop a solution.
  • We will credit you in the security advisory if you wish.

What we ask of you

  • Report the vulnerability as soon as possible and give us a reasonable amount of time, normally [90] days, before disclosing it publicly.
  • Only test devices and accounts that belong to you. Never control another person's thermostat.
  • Do not access, modify or delete other people's data. If you accidentally gain access to personal data, stop, do not save any of the data, and let us know.
  • Do not disrupt our services or other users.

Legal protection

If you follow this policy in good faith, we will consider your actions authorised. We will not report you to the police or take legal action against you for those actions.

How we handle vulnerabilities

We assess the severity and impact of the vulnerability and develop a solution. Security updates are provided free of charge and delivered via the app and, for thermostats, as over-the-air updates.

We publish security advisories on Ebeco's security page.

If a vulnerability is being actively exploited, we will report it to ENISA and CERT-SE in accordance with the EU Cyber Resilience Act (CRA) and inform affected users.

This policy was last updated on [27 October 2026].