Poindus Security
Cybersecurity Commitment
At Poindus, part of the Compal Group, we recognize that cybersecurity is fundamental to the trust our customers place in our technology. Every product we design — from Point of Sale Terminals, Panel PCs, Kiosks, Touch Displays, Box PCs, to Mobile Tablets — is developed with a focus on security by design and security by default.
We are committed to safeguarding businesses and end-users by ensuring that our solutions are resilient against evolving cyber threats. This commitment extends across the entire product lifecycle, from initial design and manufacturing to deployment, updates, and long-term support.
Cyber Resilience Act (CRA) Compliance
Poindus, as part of the Compal Group, is committed to full compliance with the European Union Cyber Resilience Act (CRA). This regulation establishes mandatory cybersecurity requirements for products with digital elements, ensuring that hardware and software are designed, developed, and maintained with resilience against cyber threats.
Our compliance framework is built on the following principles:
Security by Design and Default
All Poindus products are developed with integrated safeguards that protect data, system integrity, and user privacy throughout their operation.
Lifecycle Security Management
We apply robust security measures across the entire product lifecycle, covering design, manufacturing, deployment, updates, and long‑term support.
Vulnerability Handling and Transparency
We maintain clear processes for identifying, reporting, and mitigating vulnerabilities, ensuring accountability and openness at every stage.
Regulatory Alignment
Our solutions, including POS Terminals, Panel PCs, Kiosks, Touch Displays, Box PCs, and Mobile Tablets, are designed to meet the cybersecurity resilience standards required under the CRA.
Reporting mailbox：[email protected]
This reporting channel is operated with the assistance of ICSDA, Taiwan ( icsda.org.tw ).
Where possible, please include: affected product and version, vulnerability type and steps to reproduce ( PoC ), impact assessment, your preferred disclosure approach, and whether you wish to be credited or remain anonymous. Anonymous reports are accepted. Reports may be submitted in Chinese or English.
| Stage | Timeline | Description |
|---|---|---|
| Acknowledgement | Immediately upon receipt (automated) | Case number and a link to this policy |
| Initial response | Within 3 business days | Staff review the report and request further details if needed |
| Status updates | At least every 14 days | Progress updates until the case is closed |
| Remediation target | Case-by-case, based on severity | Remediation, update release, and (where applicable) a security advisory |
Update & Support Policy
Poindus is committed to maintaining the security and resilience of our products throughout their operational lifecycle. In accordance with the Cyber Resilience Act, we provide:
Timely Security Updates – Regular release of firmware and software patches to address vulnerabilities and strengthen system protection.
Defined Support Periods – Clear timelines for product support, ensuring customers receive updates and security maintenance for the duration of the product’s lifecycle.
Continuous Monitoring – Ongoing assessment of emerging threats and proactive measures to safeguard product performance and reliability.
Customer Notification – Transparent communication regarding available updates, security advisories, and recommended actions to maintain device integrity.
This policy ensures that Poindus solutions remain secure, reliable, and compliant with CRA requirements, protecting both businesses and end‑users.
Customer Guidance
To maximize the security and resilience of Poindus products, we recommend that all customers follow these best practices:
Apply Updates Promptly – Install firmware and software updates as soon as they are released to ensure protection against emerging threats.
Use Official Support Channels – Obtain updates, patches, and documentation only from Poindus’ authorized support resources to avoid compromised files.
Maintain Secure Configurations – Configure devices according to recommended security settings and avoid unnecessary exposure to external networks.
Report Issues Responsibly – Notify Poindus of any suspected vulnerabilities or security concerns through our dedicated CRA contact at
[email protected].
By following these guidelines, customers can help ensure that their Poindus solutions remain secure, reliable, and compliant with the Cyber Resilience Act.
Criteria for good-faith research
Research and reporting activities that satisfy all of the following constitute “good-faith research” under this policy:
- Conducted solely to discover and report vulnerabilities, without exceeding the minimum scope necessary to verify that a vulnerability exists
- No destruction, alteration, or deletion of any data; no impact on the availability of any system; no installation of persistent-access mechanisms
- Where contact with others’ data is unavoidable for verification, such contact is limited to the minimum necessary; the data is not copied, retained, or distributed, and is deleted after reporting
- No use of vulnerability information for extortion, threats, sale, or any other unlawful purpose
- No disclosure of vulnerability details to any third party before the coordinated disclosure date
- Compliance with the scope restrictions in Section 2 of this policy
For good-faith research that satisfies the above:
- We regard it as security testing authorized by the Company and will not assert that it violates our terms of service or license terms.
- To the extent permitted by law, we commit not to initiate civil proceedings, file criminal complaints or referrals, or claim damages in respect of such good-faith research.
- The rights of third parties ( including our upstream suppliers and other affected vendors ) are not ours to waive; activities involving third-party systems or rights fall outside this safe harbor.
- If you are unsure whether your activities comply with this policy, please contact us first; we will respond within 3 business days.
- Personal data provided by reporters is used solely for report handling, communication, and acknowledgement, in accordance with the Personal Data Protection Act of Taiwan; anonymous reports are excepted.
- We keep the contents of reports confidential until remediation is complete and public disclosure has been coordinated.
This policy is published by the Company and may be revised at any time; revisions will be announced on this page.
Questions about this policy：[email protected]
Contact Information
For inquiries related to cybersecurity and CRA compliance, please use the following channels:
CRA Security Contact
For all matters related to cybersecurity and CRA compliance,
please reach us at: [email protected]
General Support
For general support inquiries, including product assistance and customer service, please contact: [email protected]
