Ethical hacking and monitoring

At Despapeliza, protecting our customers’ information is a central pillar of our operation. To uphold the highest cybersecurity standards, we run a robust ethical hacking and continuous monitoring program, directly aligned with our Information Security Management System (ISMS) under ISO/IEC 27001.

What is ethical hacking?

Ethical hacking, also known as penetration testing or pentesting, consists of simulating cyberattacks on our systems, applications and infrastructure to identify and fix vulnerabilities before malicious actors can exploit them.

These controlled tests are carried out under strict protocols, using industry-standard methodologies such as OWASP Top 10, NIST and MITRE ATT&CK. The goal is to assess our defenses in real-world scenarios, such as:

• Attempts to access data without authorization.
• Exploitation of outdated or misconfigured services.
• Identity spoofing or session hijacking.
• Security gaps at the API level.

All findings are classified and prioritized, and remediation actions are tracked through our internal incident management process.

Why continuous monitoring matters

Security threats evolve every day. That is why continuous monitoring is critical: scheduled audits alone are not enough. Our systems are monitored 24/7 to detect:

• Unauthorized access attempts.
• Anomalous login behavior.
• Misconfigurations or open ports.
• Emerging vulnerabilities in third-party dependencies.

This monitoring combines automated tools with human oversight, which ensures fast detection of and response to any incident.

Our partner: Intruder.io

To maintain an impartial, high-quality security posture, Despapeliza works with Intruder.io, a globally recognized cybersecurity platform specializing in proactive threat detection and vulnerability management.

Intruder.io provides:

• Continuous vulnerability scanning across all our assets.
• External and internal network assessments.
• Immediate alerts on new CVEs and zero-day vulnerabilities.
• Integration with our DevOps pipelines for secure development practices.

By entrusting this function to a specialized third party, we ensure that our security is assessed independently, with no blind spots or internal bias. This approach also demonstrates transparency and accountability to our customers and auditors.

Alignment with ISO/IEC 27001

All our ethical hacking and monitoring practices are fully aligned with the controls defined in ISO/IEC 27001, including:

• A.12.6.1: management of technical vulnerabilities.
• A.16.1.4: assessment of and decision on information security events.
• A.14.2.8: system security testing.
• A.15.1.1: information security policy for supplier relationships.

Our ongoing ISO 27001 compliance ensures that risks are not only identified and mitigated, but also documented, reviewed and continuously improved within our ISMS.

By combining advanced internal controls with independent oversight from Intruder.io, Despapeliza delivers a security-first environment for managing electronic signatures, legal documents and highly sensitive data, in full compliance with international standards.