Lifetime license
Service tier of your choice
You select the tier that suits your use case — Tier 1, 2, or 3 — separately from your license. Switching is possible at any time.
What the CRA means for you as a user of our products.
From December 2027, the EU Cyber Resilience Act introduces mandatory security requirements for manufacturers of industrial software. This page shows which of our measures affect you, what we provide to you, and how to submit a security report to us — from the SBOM to the reporting channel.
What the CRA requires
Obligations catalog and how we implement it.
A concise comparison of the key CRA requirements and how we meet them operationally — many of them have long been standard practice for us, while others are being formalized as part of our CRA program.
| CRA requirement | Our implementation |
|---|---|
| Vulnerability identification | Internal code reviews and testing, continuous CVE monitoring of third-party dependencies, consideration of OPC Foundation security bulletins, and reports from customers and security researchers. |
| Vulnerability assessment | Formal classification according to CVSS v3.1 into four levels (Critical, High, Medium, Low), supplemented by a contextual assessment for the typical industrial use of our products in machine and plant control systems. |
| Patch provision | Out-of-band hotfix releases for Critical and High vulnerabilities, regular release cycle for Medium and Low. Security patches are free of charge for all users throughout the support period. |
| SBOM publication Available today | Machine-readable in SPDX 2.3 format, part of every product download. With Package URL identifiers for automated CVE cross-referencing. Already included in the download for our SDKs today; being implemented for our remaining products. |
| Security Advisories | Public advisories as a standalone format, separate from general release notes. Consistent structure with CVSS score, affected versions, workaround, and fix reference. Subscribable via RSS feed. |
| Security contact Available today | Dedicated reporting channel psirt@traeger.de with OpenPGP encryption. Discoverable via RFC 9116-compliant security.txt on our domains. |
| Coordinated Vulnerability Disclosure | Documented policy in accordance with BSI TR-03183-3 — describes scope, response times, the coordinated disclosure agreement, and transparent acknowledgment of reporters on request. |
| EU Declaration of Conformity | Self-declaration under the procedure provided for in the CRA (Module A), for the first time when the CRA takes effect on 11 December 2027. Usable as part of your supplier documentation vis-à-vis regulatory authorities. |
| Support period | Security updates for at least 5 years from the release of a product version. As long as a version is actively sold, the support period for each user begins upon purchase — it ends no earlier than 5 years after the last sale of that specific version. |
Our program
Full CRA compliance in
six phases.
We are implementing the CRA in a structured and scheduled way — four phases on a quarterly basis in 2026, two phases in 2027. The two statutory deadlines frame the program: the reporting obligations have applied since September 2026, full conformity is required by December 2027.
- Phase 1Q1 / 2026Immediate measures — security contact, security.txt, SBOM generationDone
- Phase 2Q2 / 2026Reporting preparation — CSIRT registration, start of risk analysisDone
- Phase 3Q3 / 2026Reporting readiness — reporting process in place; risk analysis and security testing documentation being finalizedIn progress Deadline Since 11 September 2026 · Reporting obligations apply
- Phase 4Q4 / 2026Technical documentation — security chapters in all product documentationIn progress
- Phase 5Q1–Q2 / 2027User documentation and security-by-design process documentationUpcoming
- Phase 6Q3 / 2027EU Declaration of Conformity and CE markingUpcoming Deadline 11 December 2027 · Full conformity
Response times
How quickly we respond to security reports.
We assess reported vulnerabilities according to CVSS v3.1 — an international standard for the consistent classification of IT security vulnerabilities. The severity level determines binding target times for initial response and provision of a fix.
| Severity | First response | Fix target |
|---|---|---|
| Critical CVSS 9.0–10.0 | within 24 hours | Hotfix within 7 days, workaround immediately once available |
| High CVSS 7.0–8.9 | within 48 hours | Hotfix within 30 days |
| Medium CVSS 4.0–6.9 | within 5 business days | next regular release |
| Low CVSS 0.1–3.9 | within 10 business days | next regular release |
These target times are our self-commitment. The actual processing time may depend on the complexity of the vulnerability and the availability of patches in affected third-party dependencies.
Versioning scheme
How to recognize a security update in our versioning scheme.
We version our products in four parts according to the scheme Major.Minor.Build.Revision — based on the Microsoft standard. We ship security patches as a revision increment, without functional changes to the product itself.
2. 51. 4. 0 2. 51. 4. 1
Only the revision changes — major, minor, and build remain identical.
For your change management, this means: a version increase in the fourth segment is specifically tailored to a particular security report and contains no functional changes. You can deploy such updates in your production environment without repeating functional testing.
Service tiers
Three tiers for your security information.
Security patches are available free of charge to all users throughout the support period — that is a CRA obligation and our position. Beyond that, we offer two service tiers that provide you with
active information and support.
Tier 1 Free
free of charge
| Tier 2 Security Services
10 % p.a.
| Tier 3 Lifecycle Services
25 % p.a.
| |
|---|---|---|---|
Your CRA baseline Compliance met — free of charge | |||
| Security patches within the 5-year period | |||
| SBOM in every release (SPDX 2.3) | |||
| Public Security Advisories with RSS feed | |||
| Security contact psirt@traeger.de | |||
Your security head start Risks in view | |||
| Email notification of vulnerabilities | — | ||
| Advance notice ahead of planned security releases | — | ||
| Technical support for security reports | — | ||
Your product security Investment protected long-term | |||
| SBOM changelog with every release by email | — | — | |
| Annual security status report per licensed product | — | — | |
| Individual consulting on your deployment scenarios | — | — | |
| Technical support for integration and configuration | — | — | |
| Functional updates and new features | — | — | |
| Compatibility updates for new operating systems and platforms | — | — | |
| Partnership in the further development of the product | — | — | |
Subscription license
Tier 3 included automatically
With a subscription license, the support and update service (Tier 3) is included — the service contract and license term run in sync.
Report a vulnerability
If you find a possible security vulnerability in our products.
Direct reporting channel
Please send security reports directly to our PSIRT channel. It is separate from our general support — this way we ensure that a report reaches the right people immediately.
PSIRT contact psirt@traeger.de
What we commit to
We confirm receipt of your report within the stated target times. During processing, we keep you informed of the status — from the initial assessment through the development of the fix to the publication of the advisory. On request, we name you as the reporter in the published advisory; on request, we handle the report anonymously.
What we do not do
We do not run a bug bounty program and do not pay financial incentives for vulnerability reports. For a report submitted under our Coordinated Vulnerability Disclosure Policy, we refrain from taking legal action against you as the reporter — you will find the full terms in the CVD Policy.
Further questions
Need more detail than
what's on this page?
- Security reports
- psirt@traeger.de PGP-encrypted available
- Compliance inquiries
- info@traeger.de
- Service contract, tier selection
- sales@traeger.de
- Phone
- +49 961 48 23 0-0
"Supplier questionnaires, technical information about our security practices, or adjustments to your service tier — talk to us directly."