Information on the activities of a managed security service provider (pursuant to Art. 8g of the NCSA)

Last updated: 26 October 2026. In case of any discrepancies, the Polish version prevails.

1. General information

Under the Polish Act of 5 July 2018 on the National Cybersecurity System (the “NCSA”, Polish: UKSC), Fundigic sp. z o.o. (“Fundigic”) is an essential entity acting as a managed security service provider offering incident handling services. Fundigic provides these services to a closed group of entities. The detailed terms of the managed security services are set out in bilateral agreements concluded between Fundigic and those entities; their content constitutes a trade secret or is information treated as confidential by the entities that receive Fundigic’s services.

Fundigic does not offer these services publicly, i.e. to an unspecified group of recipients.

2. Scope of activities and services

The services provided by Fundigic include, among others, active support in handling personal data breaches and information security incidents, including assessment of the severity of a breach and evidence collection.

Reactive services, including:

receiving and registering reports,
triage and prioritisation,
technical incident analysis,
incident severity assessment,
evidence preservation and collection,
coordination of mitigation and remediation,
support in restoring normal operations,
preparation of post-incident reports.

Proactive services, including:

monitoring,
vulnerability management,
security testing,
awareness-raising activities, including training.

3. Incident communication and coordination policy

Response teams and other parties holding information on threats or vulnerabilities affecting our clients are kindly asked to contact us in Polish or English. Sensitive information on incidents or vulnerabilities should be exchanged over an encrypted channel using the PGP key provided below.

Fundigic coordinates mitigation and remediation in cooperation with its clients and CSIRT NASK.

4. How to report incidents

Fundigic’s clients report incidents in accordance with agreed internal procedures. External parties (e.g. CSIRT teams, security researchers) should report threats or vulnerabilities affecting our clients to the dedicated e-mail address: security@fundigic.com.

5. Contact details and cryptography

Name: Fundigic sp. z o.o.
Address: Pl. Władysława Andersa 3, 61-894 Poznań, Poland
KRS (National Court Register No.): 0000332633
NIP (Tax ID): 7393748850
REGON (Statistical No.): 280407470
Time zone: CET (UTC+1) in winter / CEST (UTC+2) in summer
Incident reporting e-mail: security@fundigic.com
E-delivery address (adres do doręczeń elektronicznych): AE:PL-96039-85439-DBAVF-16

Encryption

The company accepts OpenPGP-encrypted correspondence.

Key ID: 0x4A4C88BC0B96ECD4
Fingerprint: CBAE FA38 5A47 A1CD A127 B2F6 4A4C 88BC 0B96 ECD4
Key location: https://fundigic.com/pgp-key.asc