Product Security at Utopi.
Utopi offers building intelligence products and solutions for institutional real estate: Our Utopi Multisensors™, smart heating and cooling devices, IoT solutions, etc plus the cloud platform that runs them, The Utopi Platform™. Those products sit in buildings people live and work in, so we treat security reports as a priority.
This page covers every hardware device we supply, whether we manufacture it ourselves or resell it, as well as our platform and websites. It tells you how to report a security issue and what we will do about it.
Reporting a Vulnerability.
If you believe you have found a security vulnerability in a Utopi product, The Utopi Platform™, or one of our websites, please tell us.
Email us at: vulnerability-reporting@utopi.co.uk
You do not need to give us any personal details beyond whatever you choose to share so that we can follow up, and you do not need to ask permission before reporting. A partial finding is still worth sending: report what you have, and we will work with you on the rest.
To help us triage quickly, please include as much of the following as you can:
- The affected product, system or URL, and the version or firmware version if you know it
- What the vulnerability is, and what you think an attacker could do with it
- How to reproduce it, including any proof-of-concept code or hardware setup
- Whether you have any reason to believe it is being actively exploited
- How you would prefer us to contact you
If you live or work in a building that uses Utopi devices and you have noticed something that worries you, you can use the same email address. You do not need to be a security researcher, and you do not need to know which product it is.
For product faults that are not security issues, please contact your building operator or your usual Utopi support channel instead.
What Happens Next.
We will acknowledge your report within 72 hours of receiving it. From there we will work with you to validate the issue; if we need more information to reproduce it, we will ask rather than let the report stall.
Once a report is validated, these are the timescales we commit to:
| What | When |
| We confirm scope, severity and a remediation plan | Within 30 days of validation |
| We keep you updated on progress | At least every 30 days until the issue is resolved |
| We publish an advisory | Once the update is available to affected customers, and after we have told you |
For products we manufacture and for our platform and websites, we aim to deliver a fix or mitigation within 30 days of validation for critical issues, 60 days for high, and 90 days for medium.
For third-party devices we resell, the fix comes from the original manufacturer. In those cases we commit to passing your report to the manufacturer within 3 working days of validation, pursuing it on your behalf, distributing the fix to affected customers as soon as it is available, and keeping you updated on the same 30-day cadence.
We will not disclose your identity without your consent, and we will credit you in the advisory unless you would rather stay anonymous. We will always tell you before anything is published.
Where we cannot agree a disclosure date with you, we treat 90 days from validation as a reasonable default, extendable by agreement where a fix is genuinely complex, for example where it needs a hardware change.
Utopi does not operate a paid bug bounty programme, so no payment is offered or implied for a report. We are grateful for them all the same.
Security Advisories.
We publish an advisory for every fixed vulnerability at Utopi Security Advisories. Each advisory includes:
- A description of the vulnerability and its potential impact
- The affected products and versions
- A severity rating
- The fixed version, and any action you need to take
If you operate buildings using Utopi products and would like advisories by email, contact your account manager.
Safe Harbour.
We will not pursue legal action against you for security research carried out in good faith, provided that you:
- Do not access user or resident data beyond what is needed to demonstrate the issue
- Do not run denial-of-service or volumetric tests
- Do not attack devices belonging to other people
- Give us a reasonable opportunity to fix the problem before telling anyone else
What is Out Of Scope.
Please do not test customer or building networks we do not operate, attempt social engineering against our staff, customers or residents, or run denial-of-service or volumetric tests of any kind. Vulnerabilities in third-party cloud or connectivity providers should be reported to that vendor; if you are not sure who the vendor is, send the report to us and we will route it.
Questions about any of this, email us at: vulnerability-reporting@utopi.co.uk