VONSCH develops and manufactures power electronics that control drives, power plants and battery storage. A security flaw in equipment like that has physical consequences. If you have found a vulnerability in one of our products or services, we want to hear about it before anyone else does.

Where to report

security@vonsch.sk

If you would rather not use e-mail, write to us at VONSCH spol. s r.o., Budovatelska 13, 977 03 Brezno, Slovakia. The choice of channel is yours.

Machine-readable contact details: /.well-known/security.txt

We monitor this mailbox continuously. Please do not use it for service requests, warranty claims or orders - those have their own channels and will only be delayed here.

Scope

In scope are all VONSCH products with digital elements and the services we operate:

frequency converters and inverters: NEXIFREM, UNIFREM, QUATROFREM, MVE CONTROL, NEXICONTROL, NEXIBOOST, UNIRU, PV COMP, GSE COMP, GSE CONTROL, FOTO CONTROL,
firmware and communication interfaces of those devices,
the NEXILINK remote diagnostics and connectivity layer,
control and service software: VONSCH Drive Studio, mobile applications,
online services: vonsch.sk, VONSCH Energy Cloud, VONSCH Support Center.

Out of scope are third-party devices, even when deployed alongside ours; installations we do not operate; and findings with no demonstrable security impact, such as raw automated scanner output without verification.

What to include

which product, model and firmware or software version,
what the flaw does and how to reproduce it,
the impact as you see it,
how we can reach you, and whether you want to be credited on disclosure.

English or Slovak is fine. An incomplete report is better than none - we will follow up.

What we commit to

Action	Time frame
Acknowledge receipt	within 3 business days
First substantive response	within 10 business days
Status update	at least every 30 days while the case is open
Coordinated disclosure	within 90 days of the report, or sooner by agreement

If we miss one of these, we will say so and say why.

We do not pay for reports and we run no bug bounty programme. If you would like it, we will credit you among those who helped us.

What we ask of you

Test only on equipment you own or where you have the operator's consent. Our products run in other companies' plants - testing on someone else's installation is interference with their operation, not research.
Do not damage data and do not disrupt operation. No denial-of-service testing.
Do not handle personal data. If you encounter it, stop and tell us.
No social engineering against our staff or customers, and no physical access attempts.
Do not publish the finding before we have agreed a date.

Public promise

If you report a vulnerability in good faith, follow the rules in "What we ask of you" and do only what is reasonably necessary to demonstrate the flaw, VONSCH will not file a criminal complaint against you and will not bring a civil claim against you on that account.

Testing of services we ourselves operate, within those limits, is authorised by us. Testing equipment at a customer site without the operator's consent is not - that is already in the rules above.

If, while researching in good faith, you unintentionally exceed those limits and tell us without delay, we will take that into account.

This assurance covers the conduct of VONSCH. It does not bind public authorities or third parties, such as the operators at whose sites our equipment is installed.

The assurance does not apply to conduct that breaks the rules - in particular damage to data, disruption of operation, handling of personal data, social engineering, physical access to premises, or publishing the finding before we have agreed a date.

We will not disclose the reporter's identity unless they ask us to or the law requires it.

Security advisories

Once a vulnerability is fixed and an update is available, we publish an advisory: what the flaw is, which devices and versions are affected, what the impact is and what the operator should do. Advisories appear on this page and on the support page of the affected product.

As of today we have no published security advisories.

What happens next

The VONSCH security team takes over the report, assesses it, determines severity and prepares remediation. Where a vulnerability is actively exploited or an incident is severe, Regulation (EU) 2024/2847 (Cyber Resilience Act) obliges us to notify ENISA and the national CSIRT. Those deadlines run independently of our correspondence with you.

Last updated: 18 September 2026

Reporting security vulnerabilities