Services · 02
Security & identity
Portals for certificates and smartcards, role and permission models, security reviews. For systems where a mistake costs more than a week's delay.
The problem
Security products have a usability problem
Certificates expire, smartcards get lost, PINs get forgotten. If each of these cases lands at the helpdesk as a ticket, security becomes expensive and users start looking for shortcuts.
Then there is pressure from outside. Customers that fall under NIS2 send supplier questionnaires. And under the Cyber Resilience Act, manufacturers placing products with digital elements on the EU market have had to report actively exploited vulnerabilities and severe security incidents since 11 September 2026.
What you get
Deliverables
- Self-service portals for certificates, smartcards and other security products: ordering, configuration, management
- Role and permission models, and integration with your existing sign-in and identity services
- Security review of architecture and code, with findings sorted by risk and specific fixes proposed
- Frontends for monitoring and remote access tools
- Support with the Cyber Resilience Act: software bill of materials (SBOM), vulnerability handling process, technical documentation
- Answers to NIS2 supplier questionnaires for the software we build for you
Technologies from our security projects
- Backend
- Java, Node.js
- Frontend
- Next.js, Angular
- Subject matter
- Digital certificates, smartcards, remote access and monitoring
Approach
Security comes before the first line of code
- Threat model: who would attack what, and what would the damage be? We write this down before the architecture is settled.
- Architecture with secure defaults: least privilege, separate environments, no secrets in the repository.
- Review in Berlin: security reviews are the responsibility of the Berlin team.
- Dependency checks for known vulnerabilities in the CI pipeline.
- Documentation that your audit and your questionnaires can use as it is.
From the lab
In “Learning to Probe” we study how a language model trained with reinforcement learning searches for vulnerabilities in the OWASP Juice Shop test application. What we learn there about automated attacks goes into our reviews.
Work
Security-related projects
-
Self-service portal for security products
Read the case studyEnd users order, configure and manage digital certificates and smartcards themselves. Java, Node.js, Next.js.
-
Frontends for remote access monitoring
Read the case studyTwo Angular frontends for a tool used to monitor servers and networks remotely.
Typical first step
Architecture review with a security focus
Read access to the repository, no production data. The result is a prioritised list of findings that your team can work through, with or without us. We agree scope, duration and a fixed price in writing before we start.
FAQ
Questions from CISOs and procurement
Do you do penetration testing?
We review architecture and code and look specifically for vulnerabilities. Whether your audit also needs a formal penetration test with a report, and who carries it out, we clarify in the intro call.
What security documentation do we get from you?
We describe our technical and organisational measures (TOMs) in a document you receive with the data processing agreement (AVV). We answer security questionnaires in full; further evidence on request.
Can you answer our NIS2 supplier questionnaire?
Yes, in writing and question by question. Where there is evidence, we attach it. Where there isn't, we say so.
What does the Cyber Resilience Act mean for our product?
If you place products with digital elements on the EU market as a manufacturer, you have had to report actively exploited vulnerabilities and severe security incidents since 11 September 2026. The remaining manufacturer obligations apply from 11 December 2027. We help with the SBOM, the vulnerability handling process and the technical documentation. The conformity assessment and the legal assessment stay with you.
Intro call
Let's talk about your security requirements
30 minutes with Kim Pham or Holger Spickmann. NDA beforehand if you wish, and a reply within one working day.
- info@senva.de
- Phone
- +49 30 5268 7541
- Address
- Bundesallee 32, 10717 Berlin, Germany