CUSTOMER STORY / SECURITY & COMPLIANCE / NEW ZEALAND

How FileInvite Kept Its SOC 2 Testing on Track-Starting Within 24 Hours

With an audit evidence deadline approaching, FileInvite needed independent testing across two customer portals and their APIs. Capture The Bug started within 24 hours of sign-off, delivered the first finding within the same window and supported remediation through its collaborative penetration testing platform, with evidence delivered on schedule.

<24 hrs

From sign-off to active testing

<24 hrs

To first finding delivered

2 portals

G1 and G2, including supporting APIs

The business: Trust is built into every document exchange

FileInvite helps commercial lenders, banks and credit unions collect and manage the documents they request from customers. Through branded online portals, borrowers can provide paperwork and lenders can manage the collection process in one place. The Auckland-based company also has a presence in the United States.

Those workflows involve sensitive identity, borrower and financial information. As FileInvite prepared testing evidence for its SOC 2 programme, the engagement had to do two jobs: provide technically credible assurance about the live application environment and fit a deadline that could not drift.

The challenge: An audit window, two portals and no room for a slow start

The testing scope included FileInvite’s G1 and G2 customer portals and the APIs behind them. Focusing only on front-end pages would not capture the services that enforce access to information across customers, accounts and workflows.

The team also needed results it could act on, independent documentation for its assurance process and evidence that remediated findings had been checked. Long onboarding or a report that arrived only at the end would compress the time available to resolve issues ahead of the planned reporting date.

How Capture The Bug delivered

Testing commenced within 24 hours

Once the agreement was signed and scope confirmed, CTB began testing within 24 hours. The first finding was also shared within the initial 24-hour window, giving FileInvite an early opportunity to review a confirmed issue rather than waiting for the completed assessment.

Coverage followed the data-not just the screens

The engagement covered G1, G2 and supporting APIs. It examined practical application-security questions including account boundaries, authentication and session controls, privilege changes, possible data exposure and weaknesses in document-handling workflows.

Platform-enabled findings, remediation and retesting

FileInvite’s team had access to validated findings, severity ratings and practical remediation guidance as testing progressed. Rather than waiting for a final report, the team could review findings, collaborate with security specialists and track remediation through a centralised workspace. Remediated issues were retested, and supporting security testing evidence was delivered within the planned SOC 2 window.

The outcome: Independent assurance delivered when it was needed

No extended mobilisation delay.

Testing began inside 24 hours of sign-off, preserving time in the agreed audit-evidence schedule.

Actionable insight from day one.

A finding was returned within 24 hours, so reviewing vulnerabilities could begin while testing continued.

Coverage across the real customer experience.

Both customer portals and their APIs were included, addressing the access boundaries and data flows central to FileInvite’s service.

Evidence ready for the planned window.

The engagement delivered independent testing documentation and remediation verification in time for FileInvite’s intended SOC 2 evidence needs.

The result was an expert-led security assessment supported by a collaborative penetration testing platform, combining meaningful technical scrutiny, visibility into findings and timely evidence for FileInvite’s SOC 2 assurance programme.

WHAT FILEINVITE SAYS

“We needed a penetration testing partner who could move quickly without compromising on technical depth. Capture The Bug started testing within 24 hours, and what stood out was having the findings available through their platform rather than waiting for a final report. Being able to see vulnerabilities as they were identified, collaborate directly with the security specialists and track remediation in one place made the process much easier for our engineering team, especially with our SOC 2 deadline approaching.”

Daniel Walters

CPTO, FileInvite

The takeaway

An audit deadline should shape the delivery plan, not reduce testing to a checkbox. FileInvite’s experience demonstrates the value of a defined technical scope, prompt mobilisation, early findings and verified remediation supported by documentation that is useful beyond the security team.

Working towards a SOC 2 or customer assurance deadline?

Talk to Capture The Bug about independent penetration testing scoped to your application, API estate and reporting timeline.

Talk to a Security Expert