Security vulnerability notification

Commitment Statement

Cybersecurity is a top priority for COGES Group and its specialized entities:

• alua (Digital): Cloud solutions, AI, and automation,
• CGES (Construction): Smart infrastructure and BIM modeling,
• GCT (Trading): Traceable supply chains and ethical trading,
• COGES Consulting: Strategic advisory, implementation, benchmarking.

We protect users, clients, and partners across all sectors through a holistic, collaborative approach.

Vulnerability Management

A Unified Process for All Divisions
Each COGES Group entity adheres to a rigorous security framework:

• Continuous Monitoring: Systems, services, and products (software, IoT, logistics platforms, etc.),
• Sector-Specific Collaboration: Coordination with domain-specific experts (e.g., ISO 27001 for Digital, BIM certifications for Construction).

Report a Vulnerability

Single Process, All Sectors

1. Email Notification: Send details to cert@coges.group, specifying:

• Affected division (Digital, Construction, Trading, Consulting),
• Asset type (e.g., alua web app, CGES site, GCT system, Consulting client data).

2. Common Criteria:

• Technical evidence (logs, screenshots, infrastructure diagrams),
• Compliance with sector policies (e.g., GDPR for Consulting, OCP standards for Trading).

Reporter Commitments

Applicable to all divisions:

• No Exploitation: No tampering with systems, whether software (alua), sites (CGES), logistics (GCT), or client data (Consulting).
• Legal Compliance: Local laws, IP rights, and sector regulations (e.g., NIS Directive for Digital, construction standards for CGES).

Personal Data Processing

Group-Wide Applicability

• Cross-Border Sharing: Data may be transferred between COGES entities (Digital, Construction, etc.) via BCR.
• Retention Period: Maximum 3 years, regardless of sector (aligned with GDPR and industry requirements).