1. PURPOSE AND SCOPE
1.1 This Policy explains how BIMoQ SINGLE MEMBER P.C. (the "Company"), as manufacturer, receives, handles and discloses reports of security vulnerabilities in its software products. It is published under Regulation (EU) 2024/2847 (Cyber Resilience Act).
1.2 This Policy covers BIMoQ-Model (add-in for Autodesk® Revit®), BIMoQ-Estimate (add-in for Microsoft Excel), BIMoQ-Viewer (IFC viewer) and the Preview Release, offered free of charge until 31 December 2026 (together, the "Products"), including the third-party and open-source components they contain. Those components are listed in the software bill of materials (SBOM) that accompanies the Products.
2. HOW TO REPORT A VULNERABILITY
2.1 Reports can be submitted through either of the following channels, which together form the Company's single point of contact for vulnerabilities:
(a) by e-mail to security@bimoq.com;
(b) by telephone on +30 211 0012367, on working days 09:00–17:00, Greek time.
2.2 Reports may be written in English or Greek.
2.3 A useful report states: the Product and version affected; a description of the vulnerability and its possible impact; the steps or proof of concept needed to reproduce it; and how we can contact you. If the vulnerability lies in a third-party or open-source component, please also name the component and its version.
2.4 Please do not send personal data or project data beyond what is needed to describe the issue.
3. WHAT HAPPENS AFTER YOU REPORT
3.1 We acknowledge receipt of your report within 2 working days.
3.2 We then carry out an initial assessment to establish whether the report concerns a vulnerability in a Product, which Products and versions are affected, and how severe it is. We tell you the outcome.
3.3 While we work on a fix, we keep you informed of progress at reasonable intervals and may ask you for further information.
3.4 Where the vulnerability lies in a third-party or open-source component, we also report it to the person or entity that manufactures or maintains that component.
4. COORDINATED DISCLOSURE
4.1 We ask you to keep the vulnerability confidential until it is disclosed publicly in coordination with you. Our aim is to make a fix available and disclose the vulnerability within 90 days of your report. That period may be extended by agreement where a fix needs more time.
4.2 Once a security update is available, we publish an advisory describing the vulnerability, the Products and versions affected, its impact and severity, and how users can remedy it. In duly justified cases, where we consider that the security risks of immediate publication outweigh its benefits, we may delay the advisory until users have had the opportunity to apply the update.
4.3 If you wish, we credit you by name or alias in the advisory. We do not run a bug bounty programme and do not pay for reports.
5. SECURITY UPDATES AND ADVISORIES
5.1 Security updates for the Products are provided free of charge and are accompanied by advisory information, including any action users need to take.
5.2 Advisories and release notes are published at https://help.bimoq.com/release-notes/, where users can consult them.
6. NOTIFICATION TO AUTHORITIES
Where the Company becomes aware of an actively exploited vulnerability in a Product, or of a severe incident having an impact on the security of a Product, it makes the notifications required by Regulation (EU) 2024/2847 to the CSIRT designated as coordinator (for Greece, the CSIRT of the National Cybersecurity Authority) and to ENISA, through the single reporting platform, and informs the users concerned. Information from your report may be used for that purpose.
7. GOOD-FAITH RESEARCH
7.1 When researching and reporting a vulnerability, please:
(a) not access, modify or delete data of users or of others beyond what is strictly necessary to demonstrate the vulnerability;
(b) not degrade or disrupt the operation of the Products, of the Company's systems or of users' systems;
(c) not disclose the vulnerability to anyone before coordinated disclosure under section 4.
7.2 The Company will not bring civil claims against a person who reports a vulnerability in good faith and in accordance with this Policy. This is an undertaking of the Company alone: it does not bind any public authority or any third party, including the owners of third-party components, and it does not affect the application of criminal law.
8. PERSONAL DATA
Personal data you provide with a report, such as your name and contact details, are processed to handle the report and for the purposes of this Policy, in accordance with our Website Privacy Policy https://bimoq.com/bimoq-privacy.
9. CHANGES TO THIS POLICY
The version in force bears a version number and an effective date and is published on the website www.bimoq.com.