Security

Coordinated Vulnerability Disclosure Policy

At Keya we take the security of our products seriously. If you believe you have found a vulnerability in one of them, we appreciate you letting us know. This policy explains how to report it and what you can expect from us.

Scope

This policy applies to Keya products with digital elements and their associated software:

• Tronic PRO, Tronic MIFARE and Keya Konnect electronic locks and their firmware.
• Keya Konnect mobile app and Keya Control software.
• KLMS Cloud service.

Keya corporate systems (website, e-mail, internal systems) and third-party products are out of scope. Vulnerabilities in third-party components that affect our products are in scope.

How to report

Send your report to security@keyalocks.com. If possible, include:

• Affected product, model and firmware or software version.
• A description of the vulnerability and its possible impact.
• Steps to reproduce it or a proof of concept.
• Whether you know it is being actively exploited.
• Your contact details and whether you wish to be credited publicly.

You can write to us in English, Spanish or Catalan. Please do not send third-party personal data unless strictly necessary.

Our commitment

• We will acknowledge receipt within 3 working days.
• We will give you an initial assessment within 10 working days.
• We will keep you informed of progress until it is resolved.
• We aim to fix confirmed vulnerabilities within 90 days, depending on severity and complexity. Security updates are free of charge during each product’s support period.
• With your permission, we will publicly credit your contribution.

Coordinated disclosure

We ask you not to publish the vulnerability until a fix is available or we have agreed a date with you. Once the fix is available, we will publish a security advisory with the description, affected products, severity and the measures to take.

In accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act), Keya notifies actively exploited vulnerabilities and severe incidents to INCIBE-CERT and ENISA. You may also report a vulnerability directly to INCIBE-CERT.

Good-faith research

We will not take legal action against anyone who researches and reports in good faith in line with this policy. We ask you to:

• Test only products you own or have the owner’s permission to test.
• Not access, modify or delete other people’s data beyond what is strictly necessary to demonstrate the vulnerability.
• Not carry out denial-of-service attacks, social engineering or physical damage to installations.
• Not ask for payment in exchange for the information. Keya does not run a bug bounty programme.

Last updated: 9 November 2026