Maintenance work on the telephone system

Due to major telephone system maintenance, you might not be able to reach us via phone on
August 27th, from 14:00 to 16:00 CEST.
We apologize for the inconvenience.

Delta IBT (Europe) Product Security Policy

Scope of Policy

This policy applies to all aspects of Delta IBT (Europe) products under the LOYTEC brand, including the development, deployment, and maintenance of our building automation devices and management systems. It covers the security of our products, the protection of building data, and the protocols for responding to security incidents.

Our security objectives are:

Protection of the confidentiality, integrity, and availability of our products and services.
Ensuring the privacy and security of our customers’ data.
Compliance with relevant legal and regulatory requirements.

Product and Service Security

Delta IBT (Europe) products and services employ various security technologies and practices to safeguard our products, including:

Encryption: We use robust encryption standards to protect data in transit and at rest.
Authentication: Multi-factor authentication is available on the BMS system to ensure that only authorized users can access sensitive systems.
Access Control: Access control mechanisms are in place to restrict access to critical functions and data based on user roles.
Security Testing: Regular security testing and vulnerability assessments are conducted to identify and mitigate potential threats. Standard automatic security tests are conducted during testing and the release process.
Common Vulnerability Scoring System (CVSS v4.0): We use CVSS scores to categorize the severity of vulnerabilities identified during security assessments

CVSS Score	9.0 – 10.0	7.0 – 8.9	4.0 – 6.9	0.1 – 3.9
Category	Critical	High	Medium	Low

Detailed information about product security and secure device configuration can be found in the LOYTEC Security Hardening Guide.

Secure Software Lifecycle

Delta IBT (Europe) develops software in a secure environment based on cybersecurity standards. These include:

ISO 27001 (Information security, cybersecurity and privacy protection)
IEC 62443-3-3 (System security requirements and security levels)
IEC 62443-4-1 (Secure product development lifecycle requirements)
IEC 62443-4-2 (Technical security requirements for IACS components)
EN 18031 (Common security requirements for radio equipment Internet connected radio equipment)

Delta IBT (Europe) is planning for external certifications on those standards in 2027.

Vulnerability Reporting

Delta IBT (Europe) offers the following responsible vulnerability reporting process. We encourage our users and third parties to report vulnerabilities found in our products and services. We accept findings following common responsible disclosure processes via This email address is being protected from spambots. You need JavaScript enabled to view it..

Please provide the following information to help us to reply quickly:

Software/Firmware title
Version
Hardware model and serial number (if applicable)
Any description, logs, backups, sample exploits, packet traces, that help us understand your report
Whether and how we can contact you for further information
Whether you want to be recognized in the final report (opt-in)

The better we understand the findings, the better and faster we can react.

Our approach to handling vulnerabilities is as follows:

Receiving your report via This email address is being protected from spambots. You need JavaScript enabled to view it.: We will assign a member of the security team to handle the request. You will receive confirmation as soon as possible.
In the case of an actively exploited vulnerability, and in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14, we will:
1. Submit an early warning notification under Article 14(2)(a) within 24 hours of becoming aware of it.
2. Submit a vulnerability notification under Article 14(2)(b) within 72 hours of becoming aware of it.
Verification: We will verify the vulnerability based on the data you provided to us. You will be informed of the verification result.
Identification and classification: We will evaluate the CVSS score to determine the severity and impact of vulnerability. The reporter will be identified on the result of the analysis. Based on the CVSS score, the following measures will be taken:
1. Critical/High: A release resolving the vulnerability will be scheduled as quickly as possible. We aim for a resolution within 96 hours. In case that target cannot be met, the reporter will be notified on the schedule on a regular basis.
2. Medium: A release resolving the vulnerability will be scheduled for 30 workdays in advance.
3. Low: A fix will be contained in the next regular release.
Publishing: When a security-related release is published, the vulnerability will be disclosed on this web page, including its description, the reporter (opt-in), and possible mitigations for those users who cannot update immediately.
Where Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14(2)(c) applies, we submit a final report to the coordinating CSIRT and ENISA within 14 days after a corrective or mitigating measure becomes available. A corresponding public advisory is published on this page.
Notification: Subscribers to the Delta IBT (Europe) security mailing list will be informed.

Review and Updates

This policy is reviewed annually and updated as necessary to ensure its continued relevance and effectiveness in addressing new security challenges.

Contact Information

If you have any questions or concerns regarding this security policy, please contact our security team at:

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

For confidential transmissions please encrypt data using the following PGP public key

PGP Public Key

Document Information

Doc.-Nr.	71051702
Version	1.1.1
Date	2026-08-07

History

Version	Changes
1.1.1	Corrections only, no scope changes
1.1	Corrected standard names Added Cyber Resilience Act, Article 14 documentation
1.0	Initial Version