The security of our products and systems is very important to us. We continuously work to identify, assess and appropriately address potential security risks in our products and the associated digital components at an early stage.

If you suspect a potential security vulnerability in an OCHSNER heat pump, its control system, user interface, communication interface, app or an associated digital service, we ask you to report it to us responsibly and confidentially.

Your information helps us continuously improve the security and reliability of our products.

Upon receipt of a report, we review the information provided, assess the potential vulnerability and, where necessary, initiate appropriate measures to remedy the issue or minimise the risk.


Our expectations

To ensure that a vulnerability report can be processed appropriately and efficiently, we expect you to:

  • not exploit the vulnerability discovered beyond what is necessary for verification;
  • not cause any damage to OCHSNER heat pumps, their control systems, digital services, IT systems or data;
  • not manipulate, compromise or modify systems or installations belonging to customers, system partners or other third parties;
  • not carry out attacks on OCHSNER IT systems, heat pumps or associated infrastructures, in particular no social engineering, spam, denial-of-service, distributed denial-of-service or brute-force attacks;
  • not view, copy, modify or disclose personal, confidential or other protected data unless this is strictly necessary to verify the vulnerability;
  • document the vulnerability in a comprehensible manner and provide sufficient technical information for reproduction and assessment;
  • document the results of automated tests or scans accordingly and provide specific information indicating the suspected vulnerability. Scan results alone, without an adequate technical description, may not be assessed appropriately;
  • provide us, wherever possible, with information on vulnerabilities that are not yet known or have not yet been remedied;
  • provide a valid email address at which we can reach you for any queries and to coordinate the next steps.


Our commitments

As part of our Coordinated Vulnerability Disclosure process, we undertake to:

  • handle vulnerability reports confidentially and in compliance with the applicable statutory provisions.
  • not disclose personal data submitted in connection with a vulnerability report to third parties without your consent, unless we are legally obliged to disclose it.
  • confirm receipt of a vulnerability report and, where possible, provide you with feedback on its processing status.
  • in the event of a responsible report and compliance with the principles set out below, not initiate criminal proceedings against the reporting person, insofar as this is legally permissible. This does not apply in particular in cases of apparent criminal intent, deliberate misuse or actions that go beyond the measures required to verify the vulnerability.
  • provide a contact person for queries and confidential communication during the processing period.

Particularly relevant information for the report

Please provide the following information wherever available:

  • affected OCHSNER heat pump or product designation;
  • affected software, firmware or control system version;
  • affected digital component or interface;
  • description of the security vulnerability;
  • steps for reproducible exploitation or verification;
  • possible effects of the vulnerability;
  • where applicable, technical evidence, screenshots or log files;
  • information on whether the vulnerability has already been disclosed to third parties.

Please do not submit unnecessary personal data or confidential customer data.

Handling reported vulnerabilities

OCHSNER assesses incoming reports based on their technical relevance and the potential risk to the affected products and users.
Depending on the type and severity of the vulnerability, technical adjustments, software or firmware updates, configuration changes or other appropriate measures may be required, for example.
The processing and remediation of a vulnerability may take different amounts of time depending on its complexity, the product generation affected and the development and testing measures required.

Vulnerability report
via email

Persons reporting vulnerabilities who use their own reporting format (e.g. PDF or TXT) can submit vulnerability reports and coordination requests directly to us by email: security(at)ochsner.com

Language of the report

Vulnerability reports can be submitted in German or English.
We thank you for your support and for handling security vulnerabilities in OCHSNER heat pumps and the associated digital systems responsibly.

Vulnerabilities in our products

Please send reports concerning security vulnerabilities in OCHSNER heat pumps, control systems, user interfaces, apps, communication interfaces or other digital product components to: security(at)ochsner.com