AMTI Security

AMTI is committed to ensuring the security of our products. Review our Coordinated Vulnerability Disclosure (CVD) policy below to learn how to report vulnerabilities, or download a PDF version of the policy.

⤓ AMTI's CVD Policy

AMTI Coordinated Vulnerability Disclosure (CVD) Policy

AMTI welcomes reports of security vulnerabilities in our products. The following policy describes how to report a vulnerability and what to expect from us.

Our Commitments to You

  • We will review and investigate any reported vulnerability
  • We will not pursue legal action against researchers who act in good faith under this policy
  • We will acknowledge reporters in security advisories (with permission)
  • We will provide security updates free of charge during the product’s declared support period
  • We will notify affected users of actively exploited vulnerabilities and available mitigation

What we Ask of You

  • Provide sufficient detail for us to reproduce and assess the issue
  • Act in good faith. The following activities are not authorized and are not covered by the good-faith assurance under this policy:
    • Denial-of-service testing
    • Physically damaging devices
    • Accessing, modifying, or deleting data that is not yours
    • Social engineering of AMTI staff or customers
    • Exploiting vulnerabilities beyond what is needed for demonstration
  • Coordinate disclosure — allow reasonable time for remediation before public disclosure
  • Submit in English — our resources operate most effectively in the English language.

Scope of the CVD Policy

This policy covers all AMTI products with digital elements available in the EU (see table for details). If you are unsure whether a product is included, please contact AMTI.

Note: OPT-SC units classified as medical devices are handled under separate medical device regulations and are not covered by this policy.

ScopeTable

How to Report a Vulnerability

If you discover a vulnerability:

Please include, wherever possible:

  • The model of the affected product and version
  • Steps to reproduce the vulnerability
  • The potential impact of the vulnerability

If your report is sensitive, email us first, and we will arrange an encrypted channel.

Clipboard security icon

What to Expect

We will acknowledge your report, assess it, and prioritize remediation based on severity. We coordinate disclosure timing with you before any public release and keep you informed of progress. Security updates are provided free of charge during the product’s declared support period. We will not pursue legal action against researchers who act in good faith under this policy.

Regulatory Reporting

When required by the EU Cyber Resilience Act, AMTI reports actively exploited vulnerabilities and severe security incidents to ENISA and the relevant national CSIRT via the Single Reporting Platform.

Contact

Advanced Mechanical Technology, Inc.
176 Waltham Street, Watertown, MA 02472 USA
Email: [email protected]
Web: Contact Form