06 Trust Center and Other Pages Copy (English)

Pages: /en/trust/security (required by the CRA), /en/demo, /en/contact, /en/about Voice (set 2026-10-22, site-wide): a working auditor talking. Short sentences, concrete scenes, no adjectives; say what the product does not do; name tools, versions and numbers. The live copy is guidant-ai-website/src/i18n/*.json; this file is the source draft. Chinese source: 06-trust-center-copy.md The product security page is adapted from the five FR-138 procedure documents and SECURITY.md (approved v1.1). Commitments, support periods and contact points follow those documents — do not change the numbers here; when a procedure is revised, update this page and keep the old version. Privacy policy and terms of service are not in this file; they need legal review first.

---

This page publishes the information Article 13 of the EU Cyber Resilience Act requires from manufacturers. The site must host every version of each document for at least 10 years at a stable URL. Each document shows its version and date.

Header

Headline

Guidant AI Product Security Information

Subhead

How to report a vulnerability, security advisories, support periods and software bills of materials. Published under the EU Cyber Resilience Act (CRA); all documents keep their previous versions.

1. Reporting a security vulnerability

If you find a security vulnerability in Guidant AI, email:

security@billows.com.tw

This mailbox is read and answered by security staff; it is not an automated form. If mail can't be delivered, write to billows@billows.com.tw or call +886 2 2562 3952 with the subject "Security vulnerability report." We accept Traditional Chinese and English.

If your report contains directly exploitable details, send a first message without them and we'll reply with a secure way to send the rest.

Please include: affected version and component, vulnerability type, steps to reproduce, your severity estimate, whether exploitation is known, your contact details and whether you'd like to be credited. Don't include personal or customer data that isn't your own.

Our commitments

Good-faith research: test only in environments you own or are authorized to use, don't access others' data, no denial of service or social engineering, give us reasonable time to fix, don't disclose before publication, and don't make publication conditional on payment. Within those bounds, we commit not to pursue legal action for your research. We don't currently run a bug bounty program.

📄 Full Vulnerability Disclosure Policy: [v1.1 (2026-10-19)]　Previous versions ▾

2. Security advisories

One advisory per fixed vulnerability, numbered GAI-SA-<YYYYMM>-<sequence>, shipped with the corresponding security update and emailed to customer administrators.

Each advisory expands to show: description, affected products and versions, impact, severity (CVSS), fix or mitigation, credits.

3. Support period

Every version is supported for at least 5 years from the date it is first made available in the EU. A major version series ends on the latest end date of any version in it.

• Security updates are free during the support period, with no maintenance contract required.
• Customers are notified at least 6 months before support ends, with the upgrade path.
• Security updates ship as complete new installer packages applied by the customer's administrator; the product does not download or install updates itself (it runs in customer-managed environments where downtime and database upgrades are the customer's call).
• Every security update remains available for at least 10 years after release.

📄 Full Support Period Statement: [v1.1 (2026-10-19)]　Previous versions ▾

4. Software Bill of Materials (SBOM)

Every version ships with a CycloneDX SBOM covering backend application dependencies and five container images (backend, sandbox, frontend, database init, error tracking).

Before every release and at least monthly, the SBOM is checked against known-vulnerability databases; anything affecting the product is handled under the Vulnerability Disclosure Policy.

5. Product security guidance

Security information for customer administrators: intended use, secure operating environment, key security features, configurations that create serious risk, and what to watch at first start-up and decommissioning.

Summary

• A single external entry point (HTTPS) at the frontend; the database and internal services are not exposed.
• Tenant data isolated at the database layer; internal connections encrypted; scanning agents connect over mutual TLS.
• Backend containers run read-only with privileges dropped; evidence files are unpacked in a sandbox with no internet access.
• The installer verifies every file against a bundled SHA-256 manifest; at startup the service verifies the vendor signature and locks itself if tampering is detected.
• Don't: expose ports other than the frontend, keep default passwords, keep using the product after support ends, or remove container security settings.
• Not provided by the product: disk encryption, scheduled backups, protection from volumetric denial-of-service — handle these at the host and network layer.

📄 Full Product Security Guidance: [v1.1 (2026-10-19)]　Previous versions ▾ 📄 Security Update and Decommissioning Procedure: [v1.1 (2026-10-19)]　Previous versions ▾

6. Declaration of conformity

Guidant AI is a default-category product under the CRA, assessed under Module A (internal production control). The EU declaration of conformity will be prepared and signed before the product is first made available in the EU, then published here and shipped with the installer.

7. Manufacturer

Footer

Last updated 2026-10-21. Document versions are kept for at least 10 years at stable URLs.

---

Header

Headline

Book a product demo

Subhead

Thirty minutes, with your framework and your scenario. Online or on site.

Form

Button: [Submit]

After submitting

Got it. We'll confirm a time by email within one working day.

Where the form goes: to be decided.

What you'll see

1. A project built on the framework you choose
2. A batch of evidence classified by AI
3. A walk through audit assessment and remediation
4. System security plan and closing report export
5. Your questions

---

Headline

Contact us

See the product: [Book a demo] General enquiries: form (name, company, email, message)

---

This page tells search engines and AI assistants that Guidant AI is a Billows Technology product. Keep the subheadline word for word — llms.txt and the structured data use the same sentence. Company facts follow https://www.billows.tech/about/ (checked 2026-10-22); update here when that page changes. The page covers the company only, not the product.

Header

Eyebrow

About us

Headline

Billows Technology 竣盟科技

Subheadline

Guidant AI is a compliance audit management platform developed and maintained by Billows Technology Co., Ltd. (竣盟科技股份有限公司).

Buttons: [Visit Billows Technology] → https://www.billows.tech/about/ (new tab), [Contact us] → /contact

Signature card (right): Guidant AI / Developed and maintained by / Billows Technology Co., Ltd. / Taipei · Founded 2013

Figures

1. Billows Technology

Founded in 2013 and headquartered in Taipei, Billows Technology focuses on cybersecurity and regulatory compliance and works as a virtual security team for its customers — from regulatory research, technical testing and consulting to AI-based monitoring and tailored solutions. More than 100 customers in Taiwan rely on it.

2. Company facts

Closing CTA

Want to see Guidant AI on your own framework?