Vulnerability Disclosure Policy

Introduction and Purpose

Takeuchi Mfg. Co., Ltd., which includes our subsidiaries in the US, UK, and France (together collectively known as “Takeuchi Group,” “we,” “us,” or “our”), is committed to the security of our products, hardware, and digital assets, and to protecting the users who rely on them. We value the work of security researchers and members of the public who help us identify and address potential vulnerabilities. This Vulnerability Disclosure Policy (“Policy”) explains how to report a suspected security vulnerability to us, what you can expect from us in return, and the guidelines we ask you to follow. This Policy is not an invitation to actively scan our network or systems for vulnerabilities, nor is it a bug bounty program. We do not offer monetary rewards or other compensation for submitting reports. We do, however, greatly appreciate responsible disclosure and will acknowledge contributions where appropriate.

Scope

This Policy applies to security vulnerabilities discovered in the following assets owned, operated, or controlled by the Takeuchi Group:

Products and hardware: Our physical products, devices, embedded firmware, and any software that operates on or is distributed with them.

Digital assets: Our public-facing websites (including www.takeuchiglobal.com), web applications, mobile applications, application programming interfaces (APIs), and internet-facing infrastructure and services.

Out of scope. The following are expressly outside the scope of this Policy and should not be tested or reported under it:

Third-party products, services, or platforms that we do not own or control, including those linked to or integrated with our assets.

Assets belonging to our vendors, partners, customers, or other third parties.

Findings from automated scanners without a demonstrated, exploitable impact.

Social engineering (e.g., phishing, vishing), physical attacks against our facilities or personnel, and denial-of-service (DoS/DDoS) attacks.

Reports of missing security best practices or configuration weaknesses without a demonstrable security impact (e.g., missing HTTP headers, weak TLS configurations, or SPF/DKIM/DMARC issues) unless you can show a concrete, exploitable risk.

Products that have reached end-of-life (EOL) or are outside their supported period, and products for which we do not bear support responsibility.

When we receive a report, we will assess whether it relates to a product within its supported period and for which we hold support responsibility, and whether it duplicates a previously received report. If we determine that investigation is not warranted on these grounds, we will inform you of that conclusion and close the matter. If you are unsure whether a system or type of testing is in scope, please contact us at the channels in Section 5 before proceeding.

Guidelines for Researchers

To ensure your activities are conducted responsibly and lawfully, we ask that you:

Make a good-faith effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.

Use only your own accounts or test accounts for security research, and do not access, modify, or delete data belonging to other users.

Limit the amount of data you access to the minimum necessary to demonstrate the vulnerability.

Once you establish that a vulnerability exists or encounter sensitive data (including personal data, credentials, or proprietary information), you must stop testing, refrain from further access, and report the finding immediately.

Do not exploit a vulnerability beyond what is necessary to confirm its existence—for example, do not pivot to other systems, escalate privileges further than needed, or exfiltrate data.

Do not use high-intensity, automated, or destructive testing techniques that could harm the availability or integrity of our products, hardware, or systems.

Keep the details of any discovered vulnerability confidential until we have had a reasonable opportunity to investigate and remediate it (see Section 6).

Comply with all applicable laws and regulations at all times.

What We Ask You Not to Do

Please do not:

Publicly disclose a vulnerability before we have confirmed that it has been resolved or that disclosure is appropriate.

Access, download, or store data that is not your own.

Demand payment or other compensation in exchange for reporting or withholding a vulnerability. Such demands may be treated as extortion and may fall outside the good-faith protections of this Policy.

Engage in any activity that would violate applicable law.

How to Report a Vulnerability

If you believe you have discovered a security vulnerability, please report it to us through one of the following channels, which are monitored by our Product Security Incident Response Team (PSIRT):

Web form: https://www.takeuchiglobal.com/en/contact-us/vulnerability-information

Email: psirt@takeuchi-mfg.com

To help us investigate and resolve the issue quickly, please include the following in your report:

The affected product name, model number, and software (or firmware) version.

A description of the vulnerability, including its nature and, where possible, a classification (for example, using CWE).

The steps required to reproduce or exploit the issue, including any proof-of-concept code, screenshots, or supporting materials.

The potential impact of the vulnerability and, if available, a severity assessment (for example, a CVSS base score). A severity score is optional.

Your contact information (including the email address to which we should reply) so we can follow up with any questions.

Any personal data you provide in a report (such as your name, email address, or phone number) will be processed by the Takeuchi Group, as data controller, solely to receive, investigate, respond to, and coordinate the resolution of your report. Our legal basis for this processing is your consent and our legitimate interest in maintaining the security of our products and systems, and we process this data otherwise in accordance with our Privacy Policy, available at www.takeuchiglobal.com/privacy. Because the Takeuchi Group operates internationally, your information may be transferred to and processed in countries other than your own, including where our subsidiaries are located, with steps reasonably necessary to keep it secure and handled in accordance with the Privacy Policy. We retain your data only for as long as necessary for the purposes above and to comply with our legal obligations. Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw your consent at any time, as well as the right to lodge a complaint with a data protection authority. Where your report or our related processing involves individuals in the EU or UK, we handle personal data consistent with the General Data Protection Regulation (GDPR) as described in that Privacy Policy.

If you contact us through a general telephone line or a sales or service representative rather than the channels above, please note that your report will be forwarded internally to the PSIRT for handling. Please submit reports in English where possible. We encourage you to submit only one vulnerability per report unless you need to chain issues to demonstrate impact.

Our Commitment and Response Process

When you submit a report in accordance with this Policy, you can expect us to:

Acknowledge receipt of your report, sent to the email address in your submission, within 5 business days.

Assess the report and work to validate the vulnerability, requesting additional information from you if needed.

Provide an estimated timeline for remediation where reasonably practicable, and keep you informed of significant progress.

Report back to you on the outcome of our investigation and the measures taken, ordinarily before any public disclosure.

Recognize your contribution, including through an acknowledgment, where you wish to be credited and where doing so is appropriate.

We aim to remediate confirmed vulnerabilities in a timely manner based on their severity and complexity. We ask that you allow us a reasonable period—generally at least [90] days—to resolve an issue before any public disclosure, and that any public disclosure be coordinated with us.

Coordination and public disclosure. Where appropriate, we coordinate our handling of reported vulnerabilities with relevant computer security incident response organizations, including JPCERT/CC and the Information-technology Promotion Agency (IPA), and follow their designated reporting procedures. We may publicly disclose a vulnerability where, for example, we receive notification of the vulnerability from an external security organization or researcher, we are unable to identify and directly notify all affected customers, or we otherwise determine that public disclosure is the appropriate means of resolving the issue. Where we notify affected customers directly, we will do so in accordance with our internal procedures.

Safe Harbor

We consider security research and vulnerability disclosure activities conducted consistent with this Policy to be authorized conduct. If you make a good-faith effort to comply with this Policy during your research, we will:

Not pursue or support any civil or criminal legal action against you in connection with your research, and will consider your access to be authorized;

Treat activity conducted in accordance with this Policy as authorized under applicable anti-hacking and computer-crime laws (such as the U.S. Computer Fraud and Abuse Act) and, to the extent applicable, waive any claim under the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA); and

Work with you to understand and resolve the issue promptly, and recognize your contribution as described in Section 6.

This safe harbor applies only to legal claims within our control. It does not bind independent third parties whose systems, data, or rights may be implicated by your research, and it does not authorize you to access, modify, or destroy data belonging to others. If legal action is initiated by a third party against you for activities conducted consistent with this Policy, we will make this authorization known where appropriate to the extent we are able to do so. The protections of this safe harbor apply only so long as you comply with this Policy. Activities that are inconsistent with this Policy—including intentional harm to systems or data, accessing data beyond what is necessary to demonstrate a vulnerability, or demanding payment in exchange for reporting or withholding a vulnerability—fall outside this safe harbor and may expose you to legal liability. Nothing in this Policy grants you permission to act in any manner that is inconsistent with applicable law or that would cause the Takeuchi Group to be in breach of any of its legal obligations. If you are unsure whether a specific action is consistent with this Policy, please contact the PSIRT through the channels in Section 5 before proceeding. We reserve the right to amend this Policy at any time. Reports submitted under this Policy will be governed by the version of the Policy in effect at the time of submission.

Questions

If you have any questions about this Policy or wish to clarify whether a particular activity is authorized, please contact the PSIRT through the channels in Section 5 before proceeding.

This Policy was last updated on August 31, 2026.