A genuinely deployed product state
Core communication, device, cryptographic and operating workflows are deployed in production and bounded through the published release and evidence path.
VENTEX CONNECT / PRODUCT SECURITYPUBLIC CONTROL RECORD · 2026-09-06
Support boundaries are part of the product.
This page connects product state, the security-update path, support boundaries, vulnerability handling and regulatory preparation. It publishes only what is genuinely committed today—and what deliberately remains open.
What “Controlled Production Release” actually means.
Not an anonymous mass rollout
Access, operating context, deployment and responsibilities are reviewed before use. The status is not an open self-service release.
General availability remains a separate gate
Broad availability, general support commitments and standardised commercial terms are not automatically part of this product state.
No certification by wording
Controlled Production Release does not mean an independent security audit, certification, regulatory approval or approval for classified information.
The current public support framework.
No implied lifetime promises: version, update path and ownership must be reviewable for every deployment.
- SUP-01ACTIVE
Current release line
The current deployed state is identified through the Release Centre, signed runtime manifest and dated product evidence. Public website releases remain separate from product versions.
- SUP-02CONTROLLED
Security updates
Security-relevant changes pass through the controlled build, test, release and rollback path. Specific timelines are committed only contractually or in a published advisory.
- SUP-03NO BLANKET COMMITMENT
Previous versions
VENTEX currently publishes no blanket multi-version or long-term-support commitment. The applicable update path is agreed before deployment.
- SUP-04OPEN BEFORE GA
End of support
A general EOL calendar has not yet been published. Organisation-specific lifetime, migration and support commitments require an explicit agreement.
From report to reviewable update.
- 01
Report
Observations enter triage through the published responsible-disclosure channel with the minimum necessary data.
- 02
Triage
Scope, reproducibility, impact, affected version and remaining uncertainty are assessed separately.
- 03
Remediate and verify
Remediation, negative tests, regression, migration impact and rollback together form the release gate.
- 04
Publish in coordination
Where public notice is required, the advisory connects impact, affected versions and remediation without overstated security guarantees.
Preparation without pre-empting conformity.
The Cyber Resilience Act turns product security, vulnerability handling and update ownership into an ongoing product process. This public record is neither a declaration of conformity nor legal advice.
- Public responsible-disclosure policy and security.txt
- Dated claim ledger and explicit security boundaries
- Release Centre and signed runtime manifest
- Public status API with an explicit measurement boundary
- Machine-readable security-advisory register
- Hybrid PQXDH session establishment with ML-KEM-1024 for capable devices in the controlled version-3 rollout
- Controlled disclosure of detailed protocol and implementation material for expressly agreed confidential reviews or audits
- Formally reviewed SBOM generation and release process
- Generally published support lifetime and EOL policy
- Independent external product and cryptography review
- External multi-region end-to-end monitoring
- Formal conformity assessment where applicable
05 / PROCUREMENT
Review the concrete operating context.
Public material enables preliminary review. Architecture, privacy, contract terms and support commitments must then be assessed for the individual organisation.