Security & Compliance

Acrobits builds the softphone apps, SDK and Cloud Softphone platform that service providers and businesses put in front of their users. This page explains how we keep those products secure, how to report a vulnerability, how long we support our products, and where we stand on the EU Cyber Resilience Act.

Report a vulnerability

If you think you have found a security issue in any Acrobits product, email security@acrobits.net. The mailbox is monitored by our security team, led by our CTO.

Please include the product and version, what you found, and the steps to reproduce it. Please don’t include personal data you don’t need to show the issue.

How we handle reports

Acknowledgement. We confirm receipt within 2 business days.

Assessment. We reproduce the issue and rate its severity.

Customer notification. When a confirmed vulnerability affects our customers, we notify them promptly, normally the same business day, through the Cloud Softphone portal or their account contact.

Fix. Security fixes are prioritised by severity and ship as soon as they are ready.

Advisory. Once a fix is available, we publish an advisory on this page.

Credit. With your permission, we credit you in the advisory.

We ask researchers to give us the time to fix an issue before making it public. Our default is 90 days from your report, or earlier once a fix is available, or longer by mutual agreement.

Test only against accounts you own, and do not access other users’ data or test our customers’ production systems. We will not take legal action against anyone who reports a vulnerability in good faith, stays within this policy, and avoids harming our customers, their users or their data. We do not run a paid bug bounty.

Out of scope: our customers’ own PBX and SIP provider systems, denial-of-service testing, social engineering, and issues that require a rooted or jailbroken device.

How we secure our products

Continuous external scanning. Our internet-facing platform is scanned continuously with Intruder, which alerts us in real time to new weaknesses and emerging threats.

Mobile app security testing. Our mobile apps are tested with Ostorlab.

Encryption. Connections to our platform use TLS 1.3. Data stored with our cloud hosting providers is encrypted at rest.

Access control. Access to production systems uses multi-factor authentication and is limited by role.

Data minimisation. Our platform does not record or store call audio.

Support and security updates

Each product receives free security updates for a support period of at least five years from when it is placed on the market. For all our current products, support runs until at least October 2031. Fixes are delivered in the latest version, which users can install free of charge.

Security fixes are prioritised by severity and ship as soon as they are ready. They are delivered through the Apple App Store and Google Play for Acrobits-branded apps, through new SDK releases for developers, and to white-label customers for release under their own brand.

Security advisories

No advisories have been published yet. Once an update is available, each fixed vulnerability is listed here with its severity, the affected versions and the fixed version.

EU Cyber Resilience Act

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets security requirements for software and connected products sold in the EU. Its reporting obligations have applied since 11 September 2026, and its other requirements apply from 11 December 2027.

Our role. Alien Licensing GmbH, Baarerstrasse 2, 6300 Zug, Switzerland, is the manufacturer under the CRA of the Acrobits SDK and of apps sold under the Acrobits name. For apps our customers publish under their own name or brand, the customer is the manufacturer. In that case Acrobits supplies the software and its security updates, with the evidence and fast alerts our customers need to meet their own obligations.

Reporting. For products we manufacture, we report actively exploited vulnerabilities and severe incidents to the authorities as Article 14 of the CRA requires. Affected customers are notified promptly, normally the same business day we confirm an issue, so they can meet their own CRA deadlines.

Conformity. We are working toward full conformity for our products before 11 December 2027.

Documentation for customers. Customers can request our CRA documentation under NDA by writing to security@acrobits.net. We are building software bills of materials (SBOM) for our products and will share them with customers when they are ready.

Documents

Data Processing Agreement: available to Cloud Softphone customers on request.
Security questionnaires: send them to security@acrobits.net or to your account manager.