Delta IBT (Europe) Product Security Policy

Scope of Policy

This policy applies to all aspects of Delta IBT (Europe) products under the LOYTEC brand, including the development, deployment, and maintenance of our building automation devices and management systems. It covers the security of our products, the protection of building data, and the protocols for responding to security incidents.

Our security objectives are:

Protection of the confidentiality, integrity, and availability of our products and services.
Ensuring the privacy and security of our customers’ data.
Compliance with relevant legal and regulatory requirements.

Product and Service Security

Delta IBT (Europe) products and services employ various security technologies and practices to safeguard our products, including:

Encryption: We use robust encryption standards to protect data in transit and at rest.
Authentication: Multi-factor authentication is available on the BMS system to ensure that only authorized users can access sensitive systems.
Access Control: Access control mechanisms are in place to restrict access to critical functions and data based on user roles.
Security Testing: Regular security testing and vulnerability assessments are conducted to identify and mitigate potential threats. Standard automatic security tests are conducted during testing and the release process.
Common Vulnerability Scoring System (CVSS v4.0): We use CVSS scores to categorize the severity of vulnerabilities identified during security assessments

CVSS Score	9.0 – 10.0	7.0 – 8.9	4.0 – 6.9	0.1 – 3.9
Category	Critical	High	Medium	Low

Detailed information about product security and secure device configuration can be found in the LOYTEC Security Hardening Guide.

Secure Software Lifecycle

Delta IBT (Europe) develops software in a secure environment based on cybersecurity standards. These include:

ISO 27001 (Information security, cybersecurity and privacy protection)
ISO 62443-3-3 (System security requirements and security levels)
ISO 62443-4-1 (Secure product development lifecycle requirements)
ISO 62443-4-2 (Technical security requirements for IACS components)
IEC 18031 (Common security requirements for radio equipment Internet connected radio equipment)

Delta IBT (Europe) is planning for external certifications on those standards in 2027.

Vulnerability Reporting

Delta IBT (Europe) offers the following responsible vulnerability reporting process. We encourage our users and third parties to report vulnerabilities found in our products and services. We accept findings following common responsible disclosure processes via This email address is being protected from spambots. You need JavaScript enabled to view it..

Please provide the following information to help us to reply quicky:

Software/Firmware title
Version
Hardware model and serial number (if applicable)
Any description, logs, backups, sample exploits, packet traces, that help us understand your report
Whether and how we can contact you for further information
Whether you want to be recognized in the final report (opt-in)

The better we understand the findings, the better and faster we can react.

Our approach to handling vulnerabilities is as follows:

Receiving your report via This email address is being protected from spambots. You need JavaScript enabled to view it.: We will assign a member of the security team to handle the request. You will receive confirmation as soon as possible.
Verification: We will verify the vulnerability based on the data you provided to us. You will be informed of the verification result.
Identification and classification: We will evaluate the CVSS score to determine the severity and impact of vulnerability. The reporter will be identified on the result of the analysis. Based on the CVSS score, the following measures will be taken:
1. Critical/High: A release resolving the vulnerability will be scheduled as quickly as possible. We aim for a resolution within 96 hours. In case that target cannot be met, the reporter will be notified on the schedule on a regular basis.
2. Medium: A release resolving the vulnerability will be scheduled for 30 workdays in advance.
3. Low: A fix will be contained in the next regular release.
Publishing: When a security-related release is published, the vulnerability will be disclosed on this web page, including its description, the reporter (opt-in), and possible mitigations for those users who cannot update immediately.
Notification: Subscribers to the Delta IBT (Europe) security mailing list will be informed.

Review and Updates

This policy is reviewed annually and updated as necessary to ensure its continued relevance and effectiveness in addressing new security challenges.

Contact Information

If you have any questions or concerns regarding this security policy, please contact our security team at:

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Office Hours: Monday to Friday, 9 AM - 5 PM

For confidential transmissions please encrypt data using the following PGP public key

PGP Public Key

Document Information

Doc.-Nr.	71051701
Version	1.0
Date	2026-06-18