Smile ID's answers

Answered on 29 Sep · adds 14 to Overall, now B · 842

SIG Lite · checked against our scans

Every answer checks out

Nothing they said disagrees with what we can see from outside.

Part 1

Backed by a document
1.1Is one named person responsible for information security?
Yes · Their Chief Information Security Officer
From their ISO 27001 Statement of Applicability, Control A.5.2, page 3
Backed by a document
1.2Do you have a written security policy, reviewed in the last 12 months?
Yes
From their ISO 27001 Statement of Applicability, Control A.5.1, page 2
Backed by a document
1.3Do staff take security training when they join, and every year after?
Yes
From their ISO 27001 Statement of Applicability, Control A.6.3, page 4
Taken on trust
1.4Do you check the background of staff who can reach customer data?
Yes

Part 2

Tested by us
2.1Does every administrative login ask for a second factor (MFA)?
Yes · Hardware keys or an authenticator app
We checked: Every admin login we can see asks for a second step.
Tested by us
2.2Are admin and control panels reachable only from your own network or a VPN?
Yes
We checked: No admin or control panel of theirs answers from outside.
Backed by a document
2.3When someone leaves, is their access removed within a working day?
Yes
From their ISO 27001 Statement of Applicability, Control A.5.18, page 6
Backed by a document
2.4Do you review who can reach customer systems at least every quarter?
Yes · Quarterly, signed off by the Head of Infrastructure
From their ISO 27001 Statement of Applicability, Control A.5.15, page 5

Part 3

Backed by a document
3.1Is customer data encrypted at rest?
Yes, everywhere
From their ISO 27001 Statement of Applicability, Control A.8.24, page 9
Tested by us
3.2Is all traffic to your services encrypted with TLS 1.2 or newer?
Yes
We checked: Every public host refuses anything older than TLS 1.2.
Tested by us
3.3Are the certificates on your public services renewed automatically?
Yes · Through our CDN
We checked: Every certificate we can see is valid and renews itself.
Backed by a document
3.4Are backups encrypted, kept off-site, and test-restored every quarter?
Yes · Restore tested every quarter, last in September
From their ISO 27001 Statement of Applicability, Control A.8.13, page 8

Part 4

Tested by us
4.1Are security patches applied to internet-facing systems within 14 days?
Partly · Critical within 7 days; others in the monthly window
We checked: Nothing internet-facing runs a version with a hole older than 14 days.
Backed by a document
4.2Do you have an independent penetration test at least once a year?
Yes · Last in March 2026, by an external firm
From their Penetration test report, Cover page and scope, page 1
Backed by a document
4.3Do you scan your own systems for vulnerabilities at least monthly?
Yes · Weekly external, monthly internal
From their ISO 27001 Statement of Applicability, Control A.8.8, page 7

Part 5

Backed by a document
5.1Do you have an incident response plan, tested in the last year?
Yes · Tabletop exercise in February 2026
From their ISO 27001 Statement of Applicability, Control A.5.24, page 6
Backed by a document
5.2Would you tell Tessellate Pay within 72 hours of a breach affecting their data?
Yes · Customers are told within 48 hours
From their Information security policy, Section 9.4, Customer notification
Tested by us
5.3Have you had a security breach in the last three years?
Yes
We checked: No disclosed breaches or reports in the last three years.
Taken on trust
5.4If your main site went down, could you keep the service running?
Yes

Part 6

Taken on trust
6.1Do any of your own suppliers reach Tessellate Pay's data?
Yes · AWS for hosting, SendGrid for email
Backed by a document
6.2Do you check those suppliers' security at least once a year?
Yes · Annual review of every supplier with data access
From their ISO 27001 Statement of Applicability, Control A.5.22, page 5
Taken on trust
6.3Where is Tessellate Pay's data stored?
Nigeria