Pentesting and ISO 27001

Ask us anything
1

¡Hey there!

We have a possible client that wants to build an internal portal using WeWeb, and taking information directly from their APIs. They work with big clients so security is really important for them.

So the ask us for two requisites:

I really don’t know how to approach this conversation as I think the certification would be on WeWebs part and not the app itself and I don’t know if pentesting is allowed when developing on weweb.

If not, ¿any clues on how can we circunvent this?

2

I think there is a topic about something similar around the forum, where @Raphael is saying that they pentest WeWeb. As for the ISO, someone like Slavo from the team will definitely be able to tell.

3

If this is internal rather than external, you might be able to solve the problem through self-hosting too. That way you take WW out of the mix as a service provider, shrinking your attack profile. You run the software on your own controlled servers.