by Bekjana Goxha, Information Security Management System Lead at spotixx.
We kicked off in mid-February and got our approval in August. We made it on the first try.
There was some uncertainty along the way, I learned a lot during the audit, and honestly, I’m still learning every day. We prepared a lot, and had some long internal discussions that went well into the night. What helped most was that everyone in the company understood this had to be an absolute priority. Whoever I asked for help, whether that was the dev team, marketing, or ops, everyone pitched in as fast as they could. I’m genuinely grateful for that team effort.
It was great to see how everyone contributed and wanted to get this distinctive mark. Given how tight the timeline was, and how many unknowns we had, we couldn’t have done it any other way.
What was already in place
Some parts of this were also easier than expected, because security was never bolted onto spotixx after the fact. Our infrastructure was already built and set up the right way, so access management and security around it were already there. What we actually needed to do was take a close look at process management and update our documentation, which meant sitting down to write longer reports and build out more detailed spreadsheets. It even changed my mindset. Now, whenever I do anything, I switch on my ISO filter and instantly think about whether it’s in line with ISO and what still needs to happen to meet it.
The internal audit surprise
The proudest moment for me and the team was our internal audit with Secfix, our partner for that step. They didn’t find any nonconformity. We were genuinely surprised. They gave us the all clear, with just a bit of friendly advice. What a relief. As first-timers, we didn’t expect that!
Passing the external audit
Certification also means an external audit. We worked with Proks Certification GmbH, an independent auditor who reviewed not just our security controls, but the ongoing management system behind them: how we identify risk, decide what to do about it, and keep checking that it’s working. We passed that one too, straight through. It was such a relief to get past that step.
What does ISO 27001 certification mean for a fintech?
It’s a great achievement, and it underscores what we’ve already built into our products, like our collaborative AML and fraud analytics platform, which lets banks work together to fight fraud and financial crime.
For banks and financial institutions, ISO 27001 is often a baseline expectation in vendor security questionnaires and procurement due diligence. Having it in place, and being a certified fintech, reduces friction in that process and signals that spotixx meets the bar expected of a vendor operating in a space governed by GDPR and the EU Anti-Money Laundering Directives.
After the audit is before the audit
The real work starts now, this is an ongoing journey. Next year we have to deliver all the results again and prove that we’re following all the required processes. To get there, we have check-ins every three months, we’ll all stick to that, and I’ll support the team to make it as easy as possible.
We also now have so much knowledge from the first round that it should be much easier to achieve this time: we know what to focus on, which fields are really mandatory, and there’ll be fewer late-night discussions (hopefully!).
A team effort, and an open door
A certification like this doesn’t happen because one person cares about security. It reflects documented policies, access controls, incident response processes, and regular audits that the whole company operates under.
Going through this for the first time showed us how well we work together, and how committed we are as a team to grow and level up. With well over 60 people now, that’s a great signal to put out there. If that resonates with you too, check out our open positions, we’re always looking for talent.
This is how spotixx actually runs: we do things, we learn as we go, and we don’t just state something in a mission line.