KOB Tech Corporation ("we," "our," or "the Company") is continuously committed to the security of our battery storage products and related services, including our remote-monitoring cloud and management application (collectively, "the Products"). This page describes our vulnerability disclosure policy and provides security information for using the Products safely.

Vulnerability Disclosure Policy

Article 1 (Reporting Contact)

If you discover a vulnerability in the Products, please report it to the contact below. Anonymous reports are accepted.

Email: info@kob-tech.com (please include "Vulnerability Report" in the subject line)
Address: Toseki Bldg. 12F, 4-9-3 Nihonbashi-Honcho, Chuo-ku, Tokyo 103-0023, Japan
Company: KOB Tech Corporation

Where possible, please include the following in your report:

1. The affected product and version (model number or serial number for hardware; URL for web services)
2. A description of the vulnerability and steps to reproduce it
3. The expected impact
4. Your contact information (optional)

Article 2 (Handling of Reports)

1. We will acknowledge receipt of your report within 5 business days.
2. We will investigate the report and determine its severity (with reference to CVSS and similar standards) and our response plan.
3. We will implement fixes or mitigations with a priority appropriate to the severity.

Article 3 (Status Updates)

1. We will update the reporter on the progress of our investigation and response approximately every 30 days.
2. When a vulnerability has been resolved, we will inform the reporter of the fix, the affected versions, and how the fix is applied, and will notify users via this website or other channels where users are affected.

Article 4 (Requests to Reporters)

1. Please verify vulnerabilities only on devices and accounts that you own or are authorized to use.
2. Please refrain from accessing third-party data or performing actions that disrupt service (such as DoS attacks).
3. Please refrain from publicly disclosing vulnerability information until a fix is complete and we have made an announcement (coordinated vulnerability disclosure).
4. We also accept reports made under IPA's Information Security Early Warning Partnership framework (via IPA's vulnerability reporting desk).

Using the Products Safely

Article 5 (Secure Setup)

1. The Products' remote monitoring connects only to our servers as configured at the factory. No server configuration is required on your side.
2. When connecting a device to your home Wi-Fi, use a Wi-Fi network protected with WPA2 or higher. Do not connect to unencrypted (passwordless) Wi-Fi networks.
3. If you use the management application (for distributors and administrators), be sure to change the issued initial password after your first login (8 characters or more). Do not reuse passwords across services or share them with third parties.
4. The product model number can be found on the label on the unit or on the device information screen of the management application.

Article 6 (Software Updates)

1. Device firmware updates are performed remotely by the Company and the manufacturer. No action is required on your part. Please keep the device powered on and connected to the network so updates can be applied.
2. When a security-related update is released, we will announce its content, necessity, and the expected impact of not applying it via this website or through distributors.
3. The management application is always delivered in its latest version; simply opening it in your browser applies the latest version.

Article 7 (Disclaimer When Updates Are Not Applied)

We are not liable for accidents, failures, or information leaks that occur while our security updates cannot be applied due to circumstances on your side, such as the device being disconnected from the network for an extended period. Please keep the device connected to the network at all times.

Article 8 (Support Period)

1. We continue to provide security support (vulnerability fixes) for the Products after their sale has ended.
2. If we end security support, we will announce it at least 12 months before the end date via this website and through distributors.
3. After support ends, vulnerability fixes will no longer be provided. Please understand the risks of continued use and consider upgrading to a successor product.

Article 9 (Data Erasure on Disposal or Transfer)

Devices store configuration information such as Wi-Fi credentials. If a device is disposed of or resold without erasing this data, it could be obtained by third parties. Before disposal, transfer, or return, be sure to do the following:

1. Perform a factory reset on the device to erase your configuration information, including Wi-Fi settings. Refer to the instruction manual or contact your distributor for the procedure.
2. Notify your distributor or our contact desk of the disposal or transfer. We will deactivate the device's server registration, stop collecting monitoring data, and delete the stored data.

Article 10 (Installation on a Network)

This product communicates with our servers over a 4G line or over your existing Wi-Fi network. Please check the following when installing it.

1. When using Wi-Fi, connect to an access point configured with WPA2 or later encryption. Do not use WEP or WPA (TKIP), for which practical attacks are established.
2. The product only makes outbound connections. Port opening, port forwarding, DMZ and UPnP settings on your router are unnecessary. Please do not configure them.
3. When connecting the product to a corporate network, we recommend placing it on a network segment separated from your business systems.
4. Configuration, administration and vulnerability handling of your own network equipment (routers, access points, etc.) remain your responsibility. We cannot accept liability for damages arising from them.

Article 11 (Protection Against Physical Tampering)

Physical control of the installation site is essential to keeping the product secure. We ask for your cooperation with the following.

1. Install the device in a lockable location, or in a place that third parties cannot easily reach.
2. The device has an RS-485 maintenance port and a USB port. Neither is used in normal operation. Where third parties can physically touch the device, these ports carry a risk of unauthorized operation.
3. Do not disassemble or modify the device. Disassembly or modification voids the warranty and support.
4. Physical controls at the installation site, such as entry management, locking and surveillance cameras, remain your responsibility. We cannot accept liability for damages arising from their absence.

Article 12 (When the Product Is Not in Use or Malfunctions)

1. If the product will not be used for an extended period, turn off its power. If you also notify your distributor or our contact desk, we will suspend server-side monitoring.
2. If you notice any abnormality (unusual noise, heat, odour, or abnormal indications), turn off the power immediately and contact your distributor or our contact desk.
3. Do not leave a device that is no longer in use connected and communicating. Turn off the power and follow the procedure in Article 9 for disposal or return.

Article 13 (Changes to This Page)

The content of this page may change without notice in response to product specification changes or security developments. Revised content takes effect when posted on this website.

Established: July 8, 2026
Revised: September 14, 2026