Contact

Information processing plays a key role in carrying out our tasks at VDI/VDE-IT. As a service provider, handling confidential information is part of our daily business.
If you have any comments, suggestions, or questions regarding information security, or if you would like to report vulnerabilities or incidents, we welcome your feedback.

Please feel free to contact our information security team.

As part of our environmental management system in accordance with DIN ISO 14001, we strive to improve our environmental performance and reduce the negative impact of our activities on the environment. If you have any questions or suggestions for improvement, please feel free to contact the Environmental Management Department at any time.

Here you will find further information on our environmental management and our Certificates.

If you wish to comment on or object to administrative proceedings within the prescribed time limit, please DO NOT use any of these email addresses; instead, contact the address specified in the relevant correspondence by regular mail or courier. The same applies to any other form of communication for which written form is required by law.

You can view our privacy policy here.
You can contact our data protection officer at Datenschutz@vdivde-it.de
Thank you very much!

To effectively protect whistleblowers, we offer a state-of-the-art, secure communication platform through which reports can be submitted. Here, you can confidentially report suspected misconduct—particularly in connection with possible corruption or other forms of white-collar crime. You decide for yourself whether to provide your name or remain anonymous.

Setting up a mailbox allows you to receive anonymous updates on the current status of your report and, if necessary, to exchange additional information. The confidentiality of your report is guaranteed at all times.
As of August 8, 2025, reports can only be submitted through the new whistleblower system, EQS Integrity Line.
About the Whistleblower System

However, you can also contact our internal reporting office directly, which is managed by the corruption prevention liaisons:

VDI/VDE Innovation + Technik GmbH
Abteilung Recht
Steinplatz 1
10623 Berlin
E-Mail: korruptionspraevention@vdivde-it.de

Please note that the whistleblower system should only be used for reports related to the violations described above.

For other inquiries and complaints, please contact the usual points of contact at our office.

If you discover a vulnerability in a VDI/VDE-IT web application or IT system, please let us know. To enable us to investigate and rectify the vulnerability efficiently, please observe the following rules:

1. 1. No active exploitation of the vulnerability (no downloading, deleting or altering of data; no disruption to the availability of services and applications).
   2. Do not disclose information about the vulnerability to third parties prior to official disclosure by VDI/VDE-IT.
   3. No attacks: No social engineering (e.g. phishing), denial-of-service attacks or physical attacks on systems or staff.
   4. Adequate documentation: Please provide sufficient information to reproduce and understand the vulnerability. Example: URL, affected function, description, proof of concept, expected behaviour.
   5. Confidentiality: Please use encrypted communication channels (S/MIME-encrypted email or the upload tool).

1. 1. Prompt response: We will acknowledge receipt of your report within five working days.
   2. Confidentiality: We will treat your report as confidential and will not disclose the reporting person’s personal data to third parties without their express consent, unless we are legally obliged to do so.
   3. Transparency: We will keep you informed of the progress of the investigation and any planned remedial measures.
   4. Cooperation: We will consult with you regarding the publication of vulnerability information in order to minimise risks.

5. Acknowledgement: With your consent, you (by name or alias) may be named as the discoverer on our ‘Acknowledgement’ page.
6. Remediation: We adhere to international recommendations (e.g. ENISA, NIST SP 800-216) and aim to rectify vulnerabilities within 90 days of receiving the report or to provide an appropriate interim solution
7. No legal risk from VDI/VDE-IT: Provided you act in accordance with this policy and in a responsible manner, we will not take any legal action ourselves. However, statutory reporting obligations, protective measures in favour of third parties and any rights of third parties remain unaffected.

Please send your report to:

isb@vdivde-it.de  (S/MIME)

Your report should include the following details:

Template for a vulnerability report

Once the report has been received, it will be processed in accordance with our internal CVD process, which is based on the ISO/IEC 30111 (Vulnerability Handling) and ISO/IEC 29147 (Disclosure) standards.

The following reports do not fall within the scope of this policy:

• Missing security headers (e.g. CSP, HSTS) without concrete exploitability
• Reports from automated scans without technical analysis
• DoS tests, spam, social engineering or brute-force attempts
• Vulnerabilities in third-party systems (e.g. hosting providers, external tools)
• General suggestions for improvement or best practices (e.g. password policies)

Contact

VDI/VDE Innovation + Technik GmbH

Information Security

Steinplatz 1, 10623 Berlin

Email: isb@vdivde-it.de

Website: https://vdivde-it.de/de