Company details and security

Company details

Last updated: 30 October 2026

This website and the Nemeris software are operated by:

Complaints and dispute resolution

Please contact us first, through the contact form on the website or at hey@nemerislabs.com. If you use the form, you immediately receive an automatic confirmation by email, sent from an address that does not accept replies. In either case, a person replies within 48 hours at the latest, and we provide a resolution within 14 days at the latest.

If you are a consumer in the European Union, you may refer a dispute to the alternative dispute resolution (ADR) service of the ANPC: https://reclamatiisal.anpc.ro. It is the competent body for disputes with us, because our company is registered in Romania. If you live in another EU country, the European Consumer Centre in your country can help you reach it free of charge. If you live outside the European Union, please also contact us first. You keep, in any event, the rights that the law of your country gives you.

Vulnerability Disclosure Policy

Last updated: 31 October 2026

This policy explains how to report a security issue in Nemeris, what we do with your report, and what this policy does not permit you to do.

How to report

Write to security@nemerislabs.com, with security in the subject line.

There is no public ticketing system for security reports and no bug bounty programme: we neither offer nor promise any payment.

Please include, as far as you can:

• what you did, in enough detail for us to reproduce it;
• what happened, and what you expected to happen;
• the version of Nemeris you tested;
• your operating system and shell, because Nemeris runs on your machine and its behaviour can differ from one environment to another.

Do not include other people's data, credentials that are not yours, or anything obtained from someone else's computer.

What we do, and when

If we decide not to fix a reported issue, we tell you so and explain why.

These time limits are a commitment about our response, not about how quickly a fix is released.

Coordinated disclosure

Please do not publish the details of the vulnerability for 90 days from our confirmation, or for a shorter period if the fix is released earlier. We agree the publication date with you.

Our reporting obligations

When we become aware that a vulnerability in Nemeris is being actively exploited, or that an incident has a severe impact on the security of Nemeris, we notify the authorities as required by Regulation (EU) 2024/2847 on cyber resilience (Article 14, applicable from 11 September 2026). We report through the single reporting platform, simultaneously to the CSIRT designated as coordinator and to ENISA: an early warning within 24 hours, a notification within 72 hours and a final report. For a vulnerability, the final report follows within 14 days at the latest after a corrective measure is available; for a severe incident, within 1 month of the notification at the latest.

We also inform the affected customers and, where appropriate, all customers, about the issue and about any measures they can take themselves to protect themselves.

Your report may be passed on to these authorities to the extent that the notification requires it.

Which versions receive security fixes

Every Nemeris licence receives security updates for 5 years from the date of purchase. Each security update, once released, remains available for download for at least 10 years or for the remainder of the support period, whichever is longer (Cyber Resilience Act, Article 13(8) and (9)). The same period is stated in the EULA and in the Pre-contractual Information.

Checking that a release is ours

Our releases are signed with an SSH key. Its fingerprint is SHA256:T4WBohZQtRwf8VX2Pwd553TsXYvkFYyDJKYlVtx+5BI. When you verify a Nemeris archive, the 'Good signature' line prints the fingerprint of the key that signed it; it must be this one.

What this policy covers

• The Nemeris software: everything in the package you download, including its command-line tools and its setup script.
• The archives we deliver, as delivered.
• The way Nemeris verifies signed documents and decides whether to allow or refuse an action. An error that makes Nemeris allow what it should refuse is exactly what we want to know about.
• The way Nemeris keeps or exposes local state on a computer on which it is installed.

What this policy does not cover

• Any server, domain or service on the internet, including this website and the payment page. This policy does not authorise any testing of any of our web servers, mail servers or accounts. Scanning, probing, repeated login attempts, denial-of-service attacks, social engineering and physical access are not covered and are not welcome.
• Claude Code and any other third-party software or service. Please report those to their makers.
• Any situation in which the attacker already controls the computer or already runs arbitrary code as the user.
• Findings produced only by an automated scanner, without a demonstrated impact.
• Missing hardening measures without an exploitable consequence, and behaviour documented as intended.

This policy is not a permission

This policy does not authorise the testing of anything. It only tells you how to contact us if you already have a finding. Permission for a particular activity would have to be given in writing, for that activity.

Testing on your own computer, on a lawfully obtained copy of Nemeris, does not require our permission.