To ensure that customers can use our products with peace of mind, Skydynamics Inc. (hereinafter "the Company") accepts reports regarding product security and works with relevant parties to respond promptly and appropriately.

• "HAYATE 2" series drone aircraft
• Transmitters (Control Stations/Ground Control Units)
• Flight operation applications
• Company servers that interface with the aforementioned products

The following activities are excluded from the scope:

• Flight operation applications
• Denial-of-Service (DoS) attacks
• Social engineering (e.g., attempts to manipulate or deceive Company employees)
• Physical destruction or theft
• Vulnerabilities in services provided by third parties (such as map services)

Please send the information described in section 4 below to the following email address: security@skydynamics.jp

*Reports may also be submitted via the "Early Warning Partnership for Information Security" managed by the Information-technology Promotion Agency, Japan (IPA).

• Product name, model number, and software version
• Description of the vulnerability and its potential impact
• Steps to reproduce the issue (to the extent possible)
• Reporter's contact information (anonymous reports are accepted, but please note that we will be unable to provide updates on the status of the report)

1. Acknowledgment of Receipt: We will confirm receipt of your report within 5 business days.
2. Investigation and Assessment: We will review the reported information to determine the existence of a vulnerability and assess its severity (e.g., using the CVSS framework).
3. Communication of Findings: We will inform the reporter of our assessment results and the planned course of action.
4. Implementation of Countermeasures: We will take necessary actions, such as developing and providing software patches or updates.

• Until the issue is resolved, we will, in principle, provide the reporter with progress updates every 30 days.
• We aim to resolve reported issues within 90 days of receipt. If a resolution cannot be reached within this timeframe, we will provide an explanation and an estimated timeline. Once the countermeasures are in place, we will publish details—including an overview of the vulnerability, the affected products and versions, and the steps taken to address it—on the "Security Information" page of our website.
• The timing and content of this publication will be determined in coordination with the reporter. With the reporter's consent, we will also include their name as an acknowledgment.
• When necessary, we will collaborate with the IPA or JPCERT/CC to publish the information via JVN (Japan Vulnerability Notes).

Reporters are requested to adhere to the following:

• Do not disclose information regarding the vulnerability to any third party until we have officially published the countermeasures.
• Limit your investigation to products that you personally own.
• Do not access, modify, or delete the personal information or data of others.
• Do not engage in any activity that could disrupt our services or negatively impact other users.

We will not take legal action against any reporter for investigations and reports conducted in good faith and in accordance with this policy.

There is currently no published security information (as of October 22, 2026).

October 20, 2026: Policy established