Basware's Information Security Certificates, Audit Reports and Pentest Reports for Customers as a Self-Service

 

The audit of a third-party vendor’s accounting and financial controls, the metric of how well the books of accounts are kept up. Helps a service organization (such as Basware) to examine and report on its internal controls relevant to its customers’ financial statements.

​​​​​Examines and reports on a service organization’s (Basware) internal controls relevant to the confidentiality (including privacy), availability, and processing integrity, of customer data.

Product-specific SOC audit reports are available for P2P and Network.

Latest report for Basware AP Automation (formerly P2P Alusta): Basware_AP_Automation_-_ISAE3000_Type_2_Report_-_2024.pdf

Latest report for Basware Network: Basware_Network_-_ISAE3000_Type_2_Report_-_2024.pdf

 

Basware Assurance Bridge Letter

Bridge letter is provided for the purpose to cover for the period outside the audit cycle (October- December). 

Latest Bridge Letter for AP Automation & Network: BaswareBridgeLetterJan2025.pdf

 

ISO 27001 Certificate

Basware's ISO 27001 certificate for information security management covers whole corporation globally and it is publicly available on Basware website at Certificate of Registration ISO27001 (basware.com) 

In addition to this certification, the organization uses the norm ISO/IEC 27017:2021 and ISO/IEC 27018:2020 as a source for the control set as defined in the SoA.

 

Pentest Reports

Basware performs its own internal security vulnerability testing on a release basis, and external penetration testing is carried out by independent third-party security experts on an annual basis.

Reports available to customers contain a summary of the testing carried out and Basware's management response to the findings.

Latest Pentest Attestation: Basware Cloud Services Penetration Testing Attestation 2024.pdf

Latest Pentest Management Response: Basware Cloud Services Penetration Testing Management Response 2024.pdf