Penetration Testing
Continuous automated testing, independent annual pentest, and the client's right to test
Security Testing Program
The SSM.ro platform applies a two-tier program: automated continuous testing and periodic independent penetration testing.
Continuous Security Testing
The application's source code and dependencies are scanned continuously:
| Scan Type | Scope | Frequency |
|---|---|---|
| Static Application Security Testing (SAST) | Detection of vulnerabilities in the application code | Continuous, on every build |
| Software Composition Analysis (SCA) | Detection of vulnerabilities in server-side and client-side dependencies | Continuous, on every build |
Findings are triaged and remediated as part of the standard development cycle, according to defined patching SLAs.
Independent Penetration Testing
The platform undergoes annual pentests conducted by independent third parties, as part of engagements commissioned by enterprise clients.
Important aspects:
- The resulting reports are the confidential property of the clients who commissioned them
- The reports are covered by non-disclosure agreements (NDA)
- The reports are not shared with other clients or auditors
The Client's Right to Test
Where a client requires independent assurance, the client may — upon request and subject to a coordinated rules-of-engagement agreement — conduct its own pentest of the SSM.ro platform within its own tenant.
Providing a third-party report commissioned by another client will not be offered as an alternative.
Coverage and Scope
Testing applies to the Shared model (multi-tenant). Enterprise deployments (single-tenant/dedicated) are assessed separately.
The testing scope covers:
- The SSM.ro web application (authentication, authorization, RBAC, tenant isolation)
- API endpoints
- Document upload mechanisms
- The electronic signature flow
- Infrastructure configuration (within available access limits)