Security
Last updated 30 September 2026
Found a security problem in the CarpVantage Cube or our services?
Security updates
The CarpVantage Cube (model CV-CUBE-1) receives security updates until at least 31 December 2030. Updates are delivered over the internet and only install if they are signed by CarpVantage — the Cube refuses anything else. When an update is available the Cube shows it on screen and on its own settings page.
Our product security statement of compliance (UK PSTI) and the UK declaration of conformity are on Declarations of conformity.
Reporting a vulnerability
Please include as much as you can:
- what's affected — the Cube (and its firmware version, shown on its Support page), our website, or another service;
- what you found and how to reproduce it;
- what an attacker could do with it, as you see it;
- how you'd like to be credited, if at all.
Please don't include anyone else's personal data, and don't publish details until we've had a reasonable chance to fix the problem.
What to expect
| Acknowledgement | Within 5 working days of your report. |
|---|---|
| Status updates | At least every 14 days until the issue is resolved, including our assessment and planned fix. |
| Fix | We aim to fix serious issues within 90 days, and sooner where customers are at risk. We'll agree a disclosure date with you. |
| Credit | With your permission, we'll thank you by name when the fix is released. |
Good-faith research
We won't take legal action against anyone who reports a vulnerability to us in good faith and follows this page: testing only on Cubes you own and accounts you control, not accessing or changing other people's data, not disrupting our services (for example with denial-of-service or high-volume testing), and giving us time to fix the issue before publishing.
Machine-readable contact details: /.well-known/security.txt