We follow strict procedures and international standards to ensure the security, continuity, and integrity of our systems and software. Our processes are aligned with ISO 27001:2022 standard and the Secure Software Development Lifecycle model.
Every published advisory lists the affected models and software versions, and the version that fixes the issue. Check your version in the web interface under Settings, then compare it with the table below.
Contact our security team directly instead of disclosing publicly. We acknowledge every report within three business days and keep you updated until the issue is resolved.
ISO 27001 certificate, our position on the Cyber Resilience Act and NIS2, SBOM on request, penetration test summaries and completed security questionnaires.
We publish an advisory for every vulnerability that affects SMSEagle devices, the software running on them, or our integration plugins. Each entry states which models and versions are affected and which release contains the fix, so you can decide quickly whether action is needed.
We also publish advisories when a widely reported vulnerability turns out not to affect our devices, such as log4shell or Spectre and Meltdown, so you do not have to ask.
Security advisories only, sent as soon as they are published. No marketing, no product news.
Prefer a feed? Subscribe via RSS →
An SMSEagle leaves the factory with settings that balance flexibility and security, because every network is different. Three steps take it from a working device to a hardened one.
Every release includes security fixes alongside new features. Updates are published as signed packages and installed from the web interface, with release notes describing what changed.
Our step-by-step guide covers the settings worth reviewing after installation: access control, network exposure, certificates and logging. It takes about fifteen minutes.
If you believe you have found a security issue in an SMSEagle product, please tell us before disclosing it publicly. We work with researchers in good faith and we do not pursue legal action against anyone who reports in line with this policy.
This applies to our devices, the software running on them, our integration plugins and our web services.
Email
security@smseagle.eu
PGP key fingerprint
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEZjiINhYJKwYBBAHaRw8BAQdAsgX2t/BsUvGJYe/6K3Dp1PvA/hr0kVkvutqF DHKUxcO0LVNNU0VhZ2xlIFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QHNtc2VhZ2xl LmV1PoiZBBMWCgBBFiEElKVX0UISwmVJkQdNob6WMsGDtLYFAmY4iDYCGwMFCQWj vGoFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQob6WMsGDtLaY6AEAg7a9 XuMid7KaB2gkCWDq5aqJe8pbK50w6qaRxx/JalwBANO2Pq/qv5UZ00thNw2+h62E IV6VfncNyn4p5Lmm5nwFuDgEZjiINhIKKwYBBAGXVQEFAQEHQJT0tWYA/jleMBd7 L6eJ49O0r3DbGy/Zm6rEdPrntd90AwEIB4h+BBgWCgAmFiEElKVX0UISwmVJkQdN ob6WMsGDtLYFAmY4iDYCGwwFCQWjvGoACgkQob6WMsGDtLZWlgD/Q8B7a3fX/0Oc xujv/rWdCR/8MfTPCz9FBoStDuaoxZYA/1gEdsLcoioCA5rEK+WVxwgIBzE4RL94 7Ym+Re2xmiAE =0UZs -----END PGP PUBLIC KEY BLOCK-----
Machine-readable
/.well-known/security.txt
What security and procurement teams usually ask for when evaluating SMSEagle as a vendor. If something you need is missing, ask and we will tell you whether we have it.
We maintain an Information Security Management System certified against ISO/IEC 27001:2022 by DEKRA Certification. Scope: design and distribution of telecommunications equipment, broad-scope software development and technical support. Valid until 5 August 2028.
The EU Cyber Resilience Act requires cybersecurity measures throughout the product lifecycle and mandatory reporting of exploited vulnerabilities. SMSEagle already supports these requirements through its ISO 27001-certified vulnerability management process and public disclosure policy. We are preparing for full CRA compliance in 2027, building on our EN 18031 compliance.
SMSEagle helps customers meet NIS2 requirements by delivering alerts out-of-band, over the cellular network, independent of the primary IT infrastructure. As a company, we monitor NIS2 and the Polish national cybersecurity act (KSC) as part of our ISMS.
Messages, contacts and logs are stored on the device inside your network, so in normal operation this data does not reach us. When we provide support services, for example remote access to a device, we may act as a data processor under a Data Processing Agreement (DPA). The DPA is available on request.
We build SMSEagle with security in mind from design to deployment. We use secure hardware design, secure SDLC for software, and thorough testing of the whole system. By making security measures a part of every step, we keep SMSEagle strong, reliable, and trustworthy.
Security is part of every stage, from hardware design to release, following a Secure Software Development Lifecycle that sits inside our ISO 27001 management system.
We regularly scan our code with SAST tools to find security vulnerabilities early, before we release anything
We analyze third-party and open-source components for known vulnerabilities to ensure our software supply chain remains secure and up to date.
Security testing combines automated tools with expert-driven manual reviews to uncover a broad range of potential threats and weaknesses.
Independent security professionals conduct regular penetration tests to evaluate the effectiveness of our defenses from an attacker’s perspective.
To prevent attacks, we analyze potential weaknesses and build our systems with a secure architecture, guided by threat modeling.
Before any code is integrated, peers review it to confirm it follows security best practices and to spot potential vulnerabilities.
Every reported issue follows the same tested process, whether it comes from a customer, an external researcher or our own testing. Severity decides the pace, not who reported it.
Acknowledged within three business days and logged in our tracking system.
Severity assessed with CVSS and prioritised by potential impact on customers.
Patch developed under an accelerated workflow, separate from the regular release cycle.
Fixed software version published for every affected model, with release notes.
Public advisory listing affected and fixed versions, with a CVE assigned where applicable.
No. An SMSEagle is a device installed in your own network. Messages, contacts and logs are stored on the device and leave it only through the mobile network, via your own SIM card, or through connections you configure yourself, such as an SMTP server or your monitoring system.
The device does reach out for software updates when you ask it to check, and that is the only outbound connection we initiate.
[DO UZUPELNIENIA: okres wsparcia per model, zgodnie ze stanowiskiem CRA]
Yes. Send it through the contact form and our security team will complete it. For common frameworks we may already have a completed version, which is faster for both sides.
Yes, on request. The software bill of materials lists third-party and open-source components in the release you are running, which is what most vendor assessments need for supply chain review.
Third-party components are monitored for known vulnerabilities as part of our software composition analysis. When one is reported, it goes through the same process as any other finding: triage, fix, release, advisory.
