Industries · Technology & Startups
The product demo went well. Then procurement sent a 300-line questionnaire, your best engineer lost two weeks to it, and the deal is still sitting in vendor risk review. Security stopped being a cost centre for companies like yours the moment your buyers became banks, ministries and hospitals — it is now the gate the revenue passes through. Zentara works on getting you through it, and on being worth passing.
What we are defending
The first question a competent reviewer asks and the one most answers dodge. Prove separation rather than describing the intent to separate.
Access to CI is access to production, usually with less logging and fewer approvals than the front door it bypasses.
Where it lives, who can reach it, how it leaves, and what happens on offboarding. Deletion is the answer that is least often true.
Authorisation at object level, rate limiting, and what a partner token can reach if it is stolen. Where fast-growing products break first.
Your customer inherits every one of them. A subprocessor list you cannot produce quickly is a review you will not pass quickly.
A surface in its own right. Answered from scratch each time it consumes senior engineering; answered from a maintained evidence base it takes an afternoon.
Instrument · Obligation · Commercial outcome
Sell to a bank and POJK 11 makes your security their problem to evidence, which makes it yours to demonstrate. Sell to a ministry and PP 71/2019 constrains where you may run. The obligations below are not all directly yours in law — several arrive through a contract, which is why they surface in procurement rather than from a regulator.
PSE registration
Komdigi
Requires
Registration as an electronic system provider operating in Indonesia, with the obligations that follow it.
We do
Establish where you sit, complete the position, and make it verifiable by a customer who checks — because increasingly they do.
What unblocks the deal
Registered status, evidenced
UU PDP
Republik Indonesia
Requires
Lawful processing and 72-hour breach notification. As a processor you also carry contractual duties to every controller you serve.
We do
Controller and processor mapping, data flow documentation, and a notification runbook that names who calls the customer and when.
What unblocks the deal
DPIA, data flow map, notification runbook
ISO 27001
Certifiable
Requires
A management system, certified by an accredited body. The default request from Indonesian enterprise and government procurement.
We do
Readiness and implementation scoped to your actual size — the smallest scope that is honest, rather than the largest that is billable.
What unblocks the deal
Certifiable ISMS, audit-ready
SOC 2
Attestation
Requires
An independent report on controls over a period, requested by North American and some European buyers. Not a certification, and not a substitute for ISO 27001 with a local buyer.
We do
Advise honestly on which your pipeline actually needs. Pursuing both before either is required is a common and expensive mistake.
What unblocks the deal
Readiness assessment, control evidence
POJK 11/POJK.03/2022
Inherited via contract
Requires
Where your customer is a bank, their third-party and outsourcing obligations become terms in your agreement and questions in their audit.
We do
Prepare for the bank's assessment rather than reacting to it, using the same framework we use when we sit on the bank's side of the table.
What unblocks the deal
Pre-built response pack
PP 71/2019
Inherited via contract
Requires
Where your customer is a public-scope operator, placement and residency constraints reach your architecture.
We do
Architecture and documentation that answers the residency question with a diagram rather than a clause.
What unblocks the deal
Documented data path
Review · How far you get before someone asks for a call
Most growth-stage companies are more secure than their paperwork suggests. The controls exist, the engineers are careful, and none of it is written down in a form a reviewer can accept — so a deal that was technically won stalls for six weeks in a process nobody owns. The ladder below is not a security maturity scale. It is how much of your sales cycle security is currently costing you, and the move from level three to level four is usually worth more commercially than the security improvement itself.
Procurement readiness
Ad hoc
Every questionnaire answered from scratch, by an engineer, at the expense of the roadmap.
Documented
Policies exist and answers are reusable. Claims are still assertions.
Evidenced
Each control has an artefact behind it — a test result, a log, a configuration — that a reviewer can accept.
Certified
ISO 27001 or SOC 2, current, with scope that genuinely covers the product being bought.
Pre-empted
A published trust centre answers most of the review before it starts. Reviewers verify rather than interrogate.
Highlighted: where a company selling to regulated buyers needs to be for security to stop delaying revenue.
Derived from enterprise and public sector vendor review practice
Sector threat model
What this sector answers to
The regulatory landscape for technology & startups. Our own accreditations are listed on certifications.
Track record
Penetration testing and ISO 27001 readiness delivered for scaling platforms, and third-party assessment run from the other side of the table for the banks and institutions those platforms sell into.
For companies selling into regulated buyers
The first time a bank's third-party risk team assesses you is a different experience from any customer conversation you have had. They have a framework, a mandate and no commercial incentive to be satisfied. The good news is that the framework is knowable in advance, and we spend the other half of our week on their side of the table.
Before you have to justify us internally
So here is the answer to the questions your risk committee will ask, before they ask them.
Work is scheduled around your deployment cadence, on staging wherever it is representative, and production only with a plan you agreed. Velocity is not something you should trade for this.
Findings come mapped to the frameworks your buyers actually ask about, in language you can paste into a questionnaire. A PDF nobody can use is half the job.
Chasing ISO 27001 and SOC 2 simultaneously before either is required has sunk more startup quarters than any breach. Sequence follows your pipeline, not our invoice.
You fix, we verify, the evidence updates. Charging again to confirm a fix turns remediation into a budget conversation and slows it down.
A twelve-person company does not need the programme a bank needs. Selling you one anyway is easy, and it is the reason security firms have the reputation they do here.
The durable outcome is your own team fielding a security review without escalating. That reduces what you spend with us, and it is still the right outcome.
Recommended
VAPT & Offensive Security
42 services in the catalog apply to Technology & Startups — from point-in-time pentests to red team and continuous validation.
Black-box test of internet-facing assets, perimeter exposure, and exploitable services.
Assumed-breach lateral movement, AD abuse, sensitive data discovery from inside.
WPA2/3 Enterprise, rogue AP, evil twin, BLE, guest network segregation.
Verifies VLAN/firewall isolation between zones (CDE, OT, corporate).
Kerberoasting, AS-REP, ACL abuse, BloodHound paths, hybrid identity review.
Rule base hygiene, ACL drift, hardening against CIS Benchmarks.
IKE/IPsec, SSL VPN, split tunneling, ZTNA migration readiness.
SPF/DKIM/DMARC, MTA-STS, DNSSEC, BIMI, phishing surface.
What we have written about it
APIs are now the backbone of modern digital services, powering mobile apps, cloud platforms, and internal microservices. As organisations expose more data through these interfaces, attackers increasingly target weaknesses in logic. Establishing robust API authorisation security is essential to mitig
As organisations increasingly adopt Kubernetes and containerised applications, DevSecOps teams face new security challenges. Containers accelerate development and deployment, but they also introduce potential blind spots. According to a 2026 report by Security Today, 90% of organisations running Kub
Modern enterprises ship software faster than ever. Cloud-native architectures, microservices, and continuous delivery pipelines have dramatically shortened release cycles. Features that once took months to deploy can now reach production in days or even hours. This speed creates opportunity, but it
Start with a scored maturity baseline or go straight to a specialist conversation.