Product Security & Compliance
Security Built for the Long Haul
Every connected device we ship comes with a published support period and a clear way to report security issues. Find our update commitments, vulnerability reporting process and regional compliance details, whether you are a customer, partner, researcher or regulator.
Product Security & Compliance
Every connected device we ship has a published support period, a monitored channel for security reports, and a documented process behind both.
This page is where we publish all of it. If you are a customer, partner, security researcher or regulator, start here.
Last reviewed: October 2026
Start here
Found a security issue?
Email ITsecurity@xirgo.com. We reply within 5 business days.
Automated tooling
Our security contact is machine-readable at /.well-known/security.txt.
Buying or specifying a device?
See support periods, update commitments and compliance by market below.
Reporting a vulnerability
We would rather hear about a problem from you than read about it later. We welcome reports from researchers who act in good faith.
- Email: ITsecurity@xirgo.com
- Subject line: Vulnerability Report – [Product Model]
- Encryption (optional): PGP key at /.well-known/[security-pgp-key.txt] (fingerprint C90591FE73F949C5D5B077761E5B1B1183819A7A)
- Preferred language: English
Please include the product model, the firmware or software version, a description of the issue and its possible impact, and the steps needed to reproduce it.
Reporting is free of charge. You do not need to give us your name or any other personal information. We use anything you send only to investigate and fix the issue.
What happens after you report
- Acknowledgement: within 3 business days. A member of our security team confirms receipt and gives you a reference number.
- Triage: within 10 business days. We reproduce the issue, confirm which products it may affect, and take appropriate action.
- Resolution plan: We tell you our resolution plan with timescale when required, and if we expect to publish an advisory.
- Status updates: until resolved. We update you on progress [at least every 30 days] until the issue is closed.
- Fix and disclosure. We may publish a coordinated advisory, normally within [90] days of your report. We credit you if you wish.
Scope
| Area | In scope? |
|---|---|
| Device firmware | Yes: all supported Xirgo devices within their published support period |
| Authentication and key handling | Yes |
| Communication protocols | Yes: device-to-cloud and device-to-device |
| Data handling and storage | Yes |
| Xirgo cloud platform and APIs | Yes |
| Third-party services we do not operate | No: please report these to the service owner |
| Physical attacks on devices you do not own | No |
| Social engineering of Xirgo staff or customers | No |
Safe harbour
If you follow this policy, act in good faith and give us reasonable time to respond, we will not take legal action against you or ask others to do so. Please test only devices and accounts you own or have written permission to test. Do not access or change customer data, and do not degrade service for others. [LEGAL TO APPROVE WORDING]
Security updates
Our fix targets are commitments. We measure them from the point at which triage confirms a vulnerability.
| Severity | CVSS v3.1 score | Target from confirmed triage |
|---|---|---|
| Critical | 9.0 – 10.0 | 14 days |
| High | 7.0 – 8.9 | 14 days |
| Medium | 4.0 – 6.9 | Next scheduled maintenance release |
| Low | Below 4.0 | Next scheduled maintenance release |
How updates reach your fleet
Xirgo devices receive firmware over the air. Each image is cryptographically signed, verified on the device before it is applied, and protected against rollback to an older version.
We tell customers about available security updates through their usual support channels.
Security advisories
We publish an advisory for every vulnerability that affects a supported product. When a vulnerability is actively exploited, or a severe incident affects a product, we also tell affected users what has happened and what they can do on our website: https://xirgo.com
Defined support periods
Each product receives security updates for at least five years from its first sale in a market. Once we publish an end date, we do not move it earlier. If we extend it, we publish the new date.
| Product | Markets supplied | First sale | Security updates until | Status |
|---|---|---|---|---|
| KP2 | US, UK, EU, Aus | 01/10/2024 | 5 years from first sale | Supported |
| CP4S | US, UK, EU, Aus | 01/10/2024 | 5 years from first sale | Supported |
| CRX | [MARKETS] | 01/10/2024 | 5 years from first sale | Supported |
| XVD-302 | Not yet supplied | On launch | 5 years from first sale | Pending certification |
| XVM-508 | Not yet supplied | On launch | 5 years from first sale | Pending certification |
| XFV-100 | Not yet supplied | On launch | 5 years from first sale | Pending certification |
End of support
We write to affected customers at least 12 months before a product's planned security update period ends, and we explain the options. After the end date, the device keeps working but no longer receives security updates. We disclose the support period at the point of sale, so you know it before you buy.
Regional compliance
We support regional compliance requirements for all our devices and services. As these requirements change, we ensure that compliance is maintained.
Australia: Cyber Security Act 2024 (Cth) and Cyber Security (Security Standards for Smart Devices) Rules 2025
The Rules apply from 4 March 2026 to in-scope connectable products supplied to Australian consumers. Where a Xirgo product is in scope, we meet the three baseline requirements:
- Passwords. No universal default passwords. Credentials are unique per device or set by the user on first setup.
- Reporting security issues. Published on this site, in English, free of charge, with no personal information required.
- Defined support period. Published as an end date for each product in the table above.
- Statement of compliance. Supplied with each in-scope product and available on request from ITsecurity@xirgo.com.
European Union: Cyber Resilience Act (EU) 2024/2847 and Radio Equipment Directive delegated regulation (EU) 2022/30
- Reporting, from 11 September 2026. We report actively exploited vulnerabilities and severe security incidents to the authorities through the ENISA Single Reporting Platform, within the deadlines the Act sets.
- User notification. When we report, we also tell affected users what has happened and what they can do.
- Full requirements, from 11 December 2027. Our programme is being built to meet the Act's essential cybersecurity and vulnerability handling requirements by that date.
- Radio Equipment Directive. Cybersecurity requirements under Article 3(3)(d), (e) and (f) apply from 1 August 2025. Our CE marking rests on EN 18031-1 and EN 18031-2.
United Kingdom: Product Security and Telecommunications Infrastructure Act 2022 and Regulations 2023
The UK regime applies from 29 April 2024. Where a Xirgo product is in scope, we meet its requirements:
- No universal default passwords.
- A published way to report security issues, with status updates until resolution.
- A published minimum security update period for each product.
- A statement of compliance for each in-scope product.
United States: California SB-327, Oregon HB 2395 and federal procurement standards
- California SB-327 and Oregon HB 2395. Connected devices must have reasonable security features and must not use shared default passwords. Our unique-credential design meets this.
- We align to similar requirements necessary in other U.S States when identified.
Radio and electrical certification: ACMA RCM, FCC, CE, UKCA
Radio, electromagnetic compatibility and electrical safety approvals are separate from cybersecurity compliance. We hold them for each market. Products marked pending certification are not yet supplied in the markets concerned.
Documents
| Document | Description | Format |
|---|---|---|
| Vulnerability Disclosure Policy | Full policy, scope and safe harbour terms. Version [X.X]. | PDF [LINK] |
| Security Support & End-of-Life Statement | Support periods and update commitments for each product. Version [X.X]. | PDF [LINK] |
| security.txt | RFC 9116 contact file. | Text |
| PGP public key | For encrypting reports to our security team. | Text |
Software bill of materials (SBOM)
We produce an SBOM for each firmware release. Regulators and market surveillance authorities can request it from ITsecurity@xirgo.com. Contracted customers can request it through their account manager.
Talk to us about security
Vulnerability reports and security questions
Regulators and compliance enquiries
Xirgo Holdings, Inc., 2100 Golf Road, Suit 290, Rolling Meadows, IL 60008
EU authorised representative: zh.k. Slaveikov bl. 188 Burgas 8000, Bulgaria
Product support
Customer support portal: https://xirgo.com/contact/support