Termii's answers

Answered on 21 Sep · adds 6 to Overall, now A · 927

CBN third-party risk · checked against our scans

Every answer checks out

Nothing they said disagrees with what we can see from outside.

Part 1

Backed by a document
1.1Is one named person responsible for information security?
Yes · Head of Infrastructure
From their ISO 27001 Statement of Applicability, Control A.5.2, page 3
Backed by a document
1.2Do you have a written security policy, reviewed in the last 12 months?
Yes
From their ISO 27001 Statement of Applicability, Control A.5.1, page 2
Backed by a document
1.3Do staff take security training when they join, and every year after?
Yes
From their ISO 27001 Statement of Applicability, Control A.6.3, page 4

Part 2

Tested by us
2.1Does every administrative login ask for a second factor (MFA)?
Yes · Hardware keys for every admin
We checked: Every admin login we can see asks for a second step.
Tested by us
2.2Are admin and control panels reachable only from your own network or a VPN?
Yes
We checked: No admin or control panel of theirs answers from outside.
Backed by a document
2.3Do you review who can reach customer systems at least every quarter?
Yes · Quarterly, signed off by the Head of Infrastructure
From their ISO 27001 Statement of Applicability, Control A.5.15, page 5

Part 3

Backed by a document
3.1Is customer data encrypted at rest?
Yes, everywhere
From their ISO 27001 Statement of Applicability, Control A.8.24, page 9
Tested by us
3.2Is all traffic to your services encrypted with TLS 1.2 or newer?
Yes
We checked: Every public host refuses anything older than TLS 1.2.
Backed by a document
3.3Are backups encrypted, kept off-site, and test-restored every quarter?
Yes · Restore tested every quarter, last in September
From their ISO 27001 Statement of Applicability, Control A.8.13, page 8

Part 4

Tested by us
4.1Are security patches applied to internet-facing systems within 14 days?
Partly · Critical within 7 days; others in the monthly window
We checked: Nothing internet-facing runs a version with a hole older than 14 days.
Backed by a document
4.2Do you have an independent penetration test at least once a year?
Yes · Last in March 2026, by an external firm
From their Penetration test report, Cover page and scope, page 1

Part 5

Backed by a document
5.1Do you have an incident response plan, tested in the last year?
Yes · Tabletop exercise in February 2026
From their ISO 27001 Statement of Applicability, Control A.5.24, page 6
Backed by a document
5.2Would you tell Tessellate Pay within 72 hours of a breach affecting their data?
Yes · Customers are told within 48 hours
From their Information security policy, Section 9.4, Customer notification
Taken on trust
5.3If your main site went down, could you keep the service running?
Yes

Part 6

Taken on trust
6.1Do any of your own suppliers reach Tessellate Pay's data?
Yes · Google Cloud for hosting
Taken on trust
6.2Where is Tessellate Pay's data stored?
Elsewhere in Africa