SeamlessHR's answers

9 of 14 answers sent so far · the rest due on Saturday

NDPA data processor · checked against our scans

Two answers don't match what we see

Each one shows what we saw beside it. Ask them about it and the question reaches their portal, pinned to that answer.

Part 1

Backed by a document
1.1Is one named person responsible for information security?
Yes · Their Data Protection Officer
From their ISO 27001 Statement of Applicability, Control A.5.2, page 3
Backed by a document
1.2Do you have a written security policy, reviewed in the last 12 months?
Yes
From their ISO 27001 Statement of Applicability, Control A.5.1, page 2

Part 2

Contradicted by our scan
2.1Does every administrative login ask for a second factor (MFA)?
Yes · On every system
We see: admin.seamlesshr.com signs in with a password alone, seen on Thursday.
Taken on trust
2.2When someone leaves, is their access removed within a working day?
Yes
Not answered yet
2.3Do you review who can reach customer systems at least every quarter?
They haven't answered this one yet.

Part 3

Backed by a document
3.1Is customer data encrypted at rest?
Yes, everywhere
From their ISO 27001 Statement of Applicability, Control A.8.24, page 9
Contradicted by our scan
3.2Is all traffic to your services encrypted with TLS 1.2 or newer?
Yes
We see: seamlesshr.com still accepts TLS 1.1.
Taken on trust
3.3Are backups encrypted, kept off-site, and test-restored every quarter?
Yes · Restore tested every quarter, last in September

Part 4

Backed by a document
4.1Do you have an incident response plan, tested in the last year?
Yes · Tabletop exercise in February 2026
From their ISO 27001 Statement of Applicability, Control A.5.24, page 6
Backed by a document
4.2Would you tell Tessellate Pay within 72 hours of a breach affecting their data?
Yes · Customers are told within 48 hours
From their Information security policy, Section 9.4, Customer notification
Not answered yet
4.3Have you had a security breach in the last three years?
They haven't answered this one yet.

Part 5

Not answered yet
5.1Do any of your own suppliers reach Tessellate Pay's data?
They haven't answered this one yet.
Not answered yet
5.2Do you check those suppliers' security at least once a year?
They haven't answered this one yet.
Not answered yet
5.3Where is Tessellate Pay's data stored?
They haven't answered this one yet.