Security and Vulnerability Reporting

Legal Twin is developed by Septeo Legal Solutions Deutschland GmbH. This page explains how to report a security vulnerability and how we handle it.

Manufacturer

Septeo Legal Solutions Deutschland GmbH
Brauerstraße 12
76135 Karlsruhe
Germany

Scope

This policy covers:

  • the NuGet packages STP.LegalTwin.Chat.Wpf, STP.LegalTwin.CaseKnowledge.Wpf and STP.LegalTwin.Client, including the Legal Twin components built into our desktop products (e.g. Advoware, Lexolution)
  • the Legal Twin services they connect to: Chat, Case Knowledge, Agents and Smart Legal Research

Reporting a vulnerability

Please report a vulnerability to us privately and don’t disclose it publicly before we have fixed it.

Please start the subject with “Security” and include as much of the following as you can:

  • the affected product and version
  • a description of the vulnerability and its impact
  • steps to reproduce it, or a proof of concept
  • whether you know of it being actively exploited
  • how we can reach you for questions

Every report is read and handled by our staff, not only by an automated system.

What happens next

  1. We confirm that we have received your report and keep you informed about its status.
  2. We assess the vulnerability and its severity.
  3. We fix it without delay and free of charge for our customers. Where feasible, security fixes are released separately from feature releases.

We report actively exploited vulnerabilities and severe incidents to the authorities as required by the EU Cyber Resilience Act.

Security updates

Updates to the hosted Legal Twin services reach you automatically. The desktop components load their user interface from these services, so most fixes don’t require installing anything. Fixes to the NuGet packages themselves are published as new package versions and announced in the Release Notes.