Guidant AI Product Security Information

If you find a security vulnerability in Guidant AI, email:

security@billows.com.tw

This mailbox is read and answered by security staff; it is not an automated form. If mail can't be delivered, write to billows@billows.com.tw or call +886 2 2562 3952 with the subject "Security vulnerability report." We accept Traditional Chinese and English.

If your report contains directly exploitable details, send a first message without them and we'll reply with a secure way to send the rest.

Please include: Affected version and component, vulnerability type, steps to reproduce, your severity estimate, whether exploitation is known, your contact details and whether you'd like to be credited. Don't include personal or customer data that isn't your own.

Our commitments

Good-faith research: Test only in environments you own or are authorized to use, don't access others' data, no denial of service or social engineering, give us reasonable time to fix, don't disclose before publication, and don't make publication conditional on payment. Within those bounds, we commit not to pursue legal action for your research. We don't currently run a bug bounty program.

Full documentVulnerability Disclosure Policy: v1.1 (2026-10-19)

One advisory per fixed vulnerability, numbered GAI-SA-<YYYYMM>-<sequence>, shipped with the corresponding security update and emailed to customer administrators.

Each advisory expands to show: description, affected products and versions, impact, severity (CVSS), fix or mitigation, credits.

Every version is supported for at least 5 years from the date it is first made available in the EU. A major version series ends on the latest end date of any version in it.

• Security updates are free during the support period, with no maintenance contract required.
• Customers are notified at least 6 months before support ends, with the upgrade path.
• Security updates ship as complete new installer packages applied by the customer's administrator; the product does not download or install updates itself (it runs in customer-managed environments where downtime and database upgrades are the customer's call).
• Every security update remains available for at least 10 years after release.

Full documentSupport Period Statement: v1.1 (2026-10-19)

Every version ships with a CycloneDX SBOM covering backend application dependencies and five container images (backend, sandbox, frontend, database init, error tracking).

Before every release and at least monthly, the SBOM is checked against known-vulnerability databases; anything affecting the product is handled under the Vulnerability Disclosure Policy.

Security information for customer administrators: intended use, secure operating environment, key security features, configurations that create serious risk, and what to watch at first start-up and decommissioning.

Summary

• A single external entry point (HTTPS) at the frontend; the database and internal services are not exposed.
• Tenant data isolated at the database layer; internal connections encrypted; scanning agents connect over mutual TLS.
• Backend containers run read-only with privileges dropped; evidence files are unpacked in a sandbox with no internet access.
• The installer verifies every file against a bundled SHA-256 manifest; at startup the service verifies the vendor signature and locks itself if tampering is detected.
• Don't: expose ports other than the frontend, keep default passwords, keep using the product after support ends, or remove container security settings.
• Not provided by the product: disk encryption, scheduled backups, protection from volumetric denial-of-service — handle these at the host and network layer.

Full documentProduct Security Guidance: v1.1 (2026-10-19)

Full documentSecurity Update and Decommissioning Procedure: v1.1 (2026-10-19)

Guidant AI is a default-category product under the CRA, assessed under Module A (internal production control). The EU declaration of conformity will be prepared and signed before the product is first made available in the EU, then published here and shipped with the installer.

Manufacturer

Billows Technology Co., Ltd.

Address

6F, No. 129, Songjiang Rd., Zhongshan Dist., Taipei City 104074, Taiwan

Phone

+886 2 2562 3952

General contact

billows@billows.com.tw

Security reports

security@billows.com.tw

Website

https://www.billows.tech