Francis Medical Vulnerability Disclosure

generated: '2026-08-16'
method: searched
source: https://www.francismedical.com/product-security/
name: Francis Medical Coordinated Vulnerability Disclosure (CVD) Policy
provider: Francis Medical
program:
  published: true
  type: coordinated-vulnerability-disclosure
  policy_url: https://www.francismedical.com/product-security/
  page_title: Product Security
  security_txt: false
  bug_bounty: false
  bounty_platform: null
  safe_harbor: true
contacts:
- purpose: vulnerability-report
  email: product-security@francismedical.com
  language: English
- purpose: support-complaints-adverse-events
  email: Customerservice@francismedical.com
  note: Explicitly out of scope for the CVD process; product quality complaints and
    adverse events route here instead.
scope:
  in_scope:
  - Francis Medical medical devices and any software embedded in or distributed with
    those devices
  - Software applications or local user interfaces used to operate or support Francis
    Medical products
  out_of_scope:
  - Corporate IT systems (website, email systems, etc.)
  - Third-party components not maintained by Francis Medical
  - Technical support requests
  - Adverse events and product quality complaints
commitments:
- acknowledgement within 10 business days, with a named contact person
- progress updates at intervals of no more than 30 days from acknowledgement
- risk analysis and a summary of findings provided to the reporter
- coordinated remediation and disclosure where applicable
- disclosure notifications published on the product security page and reported to
  CERTs and ISAOs where warranted
- no legal action against researchers acting in good faith under the policy
- optional public acknowledgement of the reporter, subject to their agreement
researcher_expectations:
- avoid testing that could disrupt patient treatment or system availability
- do not access or modify patient data
- do not exploit beyond what is necessary to demonstrate the issue
- allow reasonable time to investigate before public disclosure
- do not leave persistent changes to a product or system after testing
- comply with all applicable laws
report_contents_requested:
- product name, version number, and configuration details
- description of the vulnerability and the environment it was found in
- steps to reproduce or demonstrate
- supporting artifacts (screenshots, logs, proof-of-concept, evidence of exploitation)
- prior or intended disclosure to other parties (regulators, coordinators, vendors)
- reporter contact information
- 'explicit instruction: do not include personal or health information'
disclaimers:
- Submissions are treated as non-proprietary and non-confidential, and Francis Medical
  may use them without restriction.
- The process may change at any time without notice, with case-by-case exceptions.
notes:
- The policy states plainly that "our current product offerings do not include network-connected
  components", which is the provider's own confirmation that the Vanquish platform
  exposes no network or API surface today. The CVD program covers embedded device
  software and local operator interfaces, not a web API.
- The policy is part of Francis Medical's post-market surveillance program, consistent
  with FDA premarket cybersecurity expectations for medical devices.
- No RFC 9116 security.txt is served at /.well-known/security.txt (probed 404 on 2026-08-16),
  so this policy is discoverable only from the website navigation.
x-evidence:
  fetched: '2026-08-16'
  url: https://www.francismedical.com/product-security/
  http_status: 200
  content_type: text/html