of industrial communication software experience that feeds into our security work.
Compliance is part of our work — not a separate process.
Industrial communication comes with regulatory requirements that grow more complex over time. We treat them the way we treat software: systematic, documented, verifiable.
On our regulatory radar
Cyber Resilience Act:
What we are implementing by 2027 — and
what we have long been doing.
From 2027, the EU Cyber Resilience Act introduces mandatory security requirements for manufacturers of industrial software. For us, this is less a change of course than a formalization: much of what the regulation prescribes has been part of our development work for years.
We already ship SBOM data with every release today. We continuously monitor security reports for our third-party dependencies. Out-of-band hotfixes are established practice.
What the CRA restructures anew: a dedicated security contact, formal CVSS assessment, public Security Advisories, and a documented Coordinated Vulnerability Disclosure Policy.
Full CRA overviewof support for security updates from the first release of each product version.
initial response and hotfix target for critical security reports.
For your NIS2 supply chain
What we provide for your NIS2 compliance.
As an operator of essential or important entities, NIS2 requires you to assess your supply chain for IT security. If Traeger products run in your systems, you depend on reliable statements from us.
Software Bill of Materials
Machine-readable in SPDX 2.3 format, part of every product download. With Package URL identifiers for automated CVE cross-referencing in your audit tool.
EU Declaration of Conformity
Self-declaration under the procedure provided for in the CRA (Module A) for our products with digital elements, from the date the CRA takes effect. Usable as part of your supplier documentation.
Vulnerability information
Public Security Advisories with RSS feed. On request, additionally active email notification for customers with a service tier.
Supplier questionnaires
We answer LkSG and security questionnaires from your compliance department transparently and without delay. Response time usually within a week.
Dual-use and defence
BAFA-reviewed. Defence inquiries are examined, not answered reflexively.
Status under foreign trade law
Our SDKs and industrial communication products have been reviewed by the Federal Office for Economic Affairs and Export Control (BAFA). A current classification statement confirms that the OPC UA SDK is covered neither by the EU Dual-Use Regulation 2021/821 nor by the national export list, the Anti-Torture Regulation, or the Firearms Regulation.
We provide the current ruling on request.
Delivery to sanctioned countries
As a matter of principle, this does not take place. For orders from countries requiring increased scrutiny, our sales team clarifies the end use on a case-by-case basis.
Inquiries from the defence sector
Are not rejected across the board, but examined individually. A prerequisite for an offer is a written end-use declaration from the customer, ruling out NBC weapons, weapons prohibited under international law, and offensive military operations. The internal assessment follows a documented policy with management approval.
We provide the policy itself on request.
Supplier and human rights standards
What we sign — and
what we do ourselves.
Our customers' supplier questionnaires
Large customers who are themselves subject to the Supply Chain Due Diligence Act (LkSG) regularly query their suppliers on human rights and labor standards. Supplier standards based on the Responsible Business Alliance Code of Conduct are nothing new to us — we answer them transparently and sign them when they align with our values.
Our own commitment
We adhere to the UN Guiding Principles on Business and Human Rights, the ILO Core Labour Standards, and the UN Global Compact.
A dedicated policy statement on this is in preparation and will be made available here as soon as it has been signed.
Data and access control
Data protection documented.
Information security lived.
Data protection under GDPR
We process personal data in compliance with the GDPR — on our website, in contact and order forms, and when issuing licenses. Which data is processed for which purpose and on what legal basis is set out in detail in our privacy policy. Please direct data protection inquiries to privacy@traeger.de.
Our products do not phone home
This applies during evaluation, in productive use, when using a license, upon its activation, and in the event of an error. What our SDKs and Codabix communicate is exclusively what the user or developer specifies via the configuration — with the source and target systems they define themselves.
There is no telemetry channel, no analytics endpoint, no update check, no crash reporting connection to Traeger.
Information security as practice
We apply the core practices of an information security management system — including role-based access control with two-factor authentication, mandatory code reviews, digitally signed release artifacts, and regular security training for our team.
A formal certification to ISO 27001 or TISAX does not currently exist — it has not been necessary so far. As our customers' requirements grow, we will follow suit here in due course. We are happy to provide detailed information about our practices in the context of supplier audits.
Honest boundaries
What we don't do — and why that's
perfectly fine.
Compliance statements are only reliable when the gaps are named too. Three points where we deliberately make no promises.
Outside our scope
Machinery Regulation 2023/1230
Our products are data communication components. Responsibility for functional safety under the Machinery Regulation or IEC 61508/62061 remains with the machine manufacturer. We provide the data layer, not the control layer.
No certification
IEC 62443
Our SDKs can be used in 62443-compliant architectures, but are not themselves 62443-certified. Detailed information as part of a supplier audit.
No certification
ISO 27001, TISAX
No certification. We communicate specific security practices individually on request and avoid generic promises without audit evidence.
For compliance inquiries
Do you have a question that is
not answered here?
- Security reports
- psirt@traeger.de PGP-encrypted available
- Compliance inquiries
- info@traeger.de
- Phone
- +49 961 48 23 0-0
"We usually respond within a week — including to supplier questionnaires that our customers forward to us.