Security Check of the Exchange Website

Client:

Maple Pay – a fintech company that provides online currency exchange services

Industry:

FinTech

Focus:

Security check of the website and obtaining a cybersecurity certificate

Main challenge:

Confirmation of the resource’s reliability and demonstration of compliance with basic security requirements for marketing purposes

Market:

Canada

Services provided:

Web application pentest (Black-Box)

Key Takeaways

Confirmed the basic level of the platform’s cyber resilience

The client received a penetration testing certificate

An automated black-box pentest of the website was conducted

6 low-risk vulnerabilities were identified

A detailed report on the test results was prepared

vulnerabilities detected

weeks of testing duration

scanners used

Nov 4, 2025

15 min

For financial services, user trust is crucial. To confirm the platform’s reliability and demonstrate transparency of processes, Maple Pay turned to Datami for a penetration test and certification. The cybersecurity assessment of the website revealed 6 low-level vulnerabilities and confirmed the overall security level of the platform.

Maple Pay is a Canadian fintech company that provides solutions for digital payments and online currency exchange. The platform operates in accordance with FINTRAC requirements and international standards for the security of financial transactions.

For companies in the financial sector, cybersecurity is the foundation of their reputation. Any vulnerability can put transactions, data, and customer trust at risk. Therefore, a security assessment of the web platform is an essential element of Maple Pay’s strategy.

Tasks and challenges

Maple Pay sought to confirm the reliability of its website and demonstrate compliance with core financial-sector security requirements, FINTRAC, and international standards and transparency.

The company engaged Datami for an automated pentest and certification, to be completed within two weeks.

Conduct an automated black-box pentest of the company's website
Identify potential vulnerabilities and prepare a report with recommendations
Provide a certificate for the penetration test

Verification of the web platform

Test the security of the Maple Pay website using a black-box approach

Vulnerability discovery

Check for technical weaknesses and assess the level of risk to users

Certification of results

Prepare a report with recommendations and provide a penetration testing certificate

Datami methodology

Our approach

Datami applied a Black-box approach to the pentest and performed extensive automated scanning of the web platform. For this, they used 6 tools: Nikto, Wapiti, OWASP ZAP, Nuclei, Nessus, and Burp Scanner.

For initial reconnaissance, the OSINT methodology was chosen. The DDoS simulation was adapted to the WAF, and the attack simulation was fully controlled and agreed with the client - time windows, rollback, and monitoring were prearranged.

Black-box

Pentest strategy without access to source code for assessing surface attack vectors. It simulates the actions of external attackers.

Key stages of work and solutions

The Datami team followed a clear sequence to minimize risks for the platform.

They began with OSINT reconnaissance, followed by extensive automated scanning and a controlled DDoS simulation.

In the final stage, they performed a detailed analysis and prepared a comprehensive report with conclusions and recommendations.

OSINT reconnaissance

Collected publicly available technical information about the target: domains, subdomains, technologies, and potential leaks.
Scanning and DDoS simulation

Launched 6 scanners considering the active WAF and conducted a controlled load simulation with monitoring and rollback mechanisms.
Analysis and reporting

Validated findings, classified risks, compiled a detailed report, and provided recommendations to improve cybersecurity.

Results and recommendations

As a result of the automated pentest of the Maple Pay web platform, the Datami team identified 6 low-level vulnerabilities. They did not pose a critical threat but could affect the platform’s stability and user experience.

Following the assessment, the client received a detailed report outlining each vulnerability and its risk level.

In cases where only non-critical threats are detected, Datami experts recommend:

updating CMS components and library versions;
strengthening WAF configurations to reduce potential load;
regularly scanning for common web vulnerabilities and performing retests after major site updates;
planning annual security assessments to maintain regulatory compliance.

This approach helps maintain a proper level of cybersecurity and prepare for future audits.

Key project takeaways

In the financial sector, user trust is just as important as technological stability. Maple Pay initiated a cybersecurity assessment not only to test the platform but also to demonstrate transparency and a responsible approach to data protection.

This Datami case study confirmed that automated pentesting is an effective tool for showcasing service reliability. The company received a testing certificate, a clear understanding of its current security level, and a foundation for future audits.

Direction

Before the project

After the pentest

Risk level

Unknown

Low

Vulnerabilities

Not officially recorded

6 low-level vulnerabilities identified

Platform resilience

Unknown

Basic level of cyber resilience confirmed

Timeline

–

Project completed in 2 weeks

Mobile App Security Outstaff Audit

Identified dangerous configurations and data leaks
Strengthened security before product launch

Services:

Mobile app pentesting, AWS pentesting, code security audit

Nov 20, 2025

Security Policy Audit for a Fintech Company

Seven key cybersecurity policies were reviewed and assessed
Regulations aligned with ISO 27001, DORA, GDPR, and NBG

Services:

Security policy and compliance audit

Nov 20, 2025

Security Testing of the DonorUA Medical Platform

Provided a security recommendations report.
No critical security threats were confirmed.

Services:

Web application pentest (Black-box)

Nov 18, 2025

Back to all cases

Datami articles

Modern Phishing Campaigns Use PDF Files for Attacks

Datami Newsroom

Modern Phishing Campaigns Use PDF Files for Attacks

Next-generation phishing campaigns disguise themselves as well-known brands and use artificial intelligence to mislead users. In 2025, companies face a wave of sophisticated attacks that are changing cybersecurity rules.

Nov 24, 2025 3 min

Datami Newsroom

KillSec Ransomware Attacks Healthcare

The hacker group KillSec has recently been actively attacking the IT systems of the healthcare sector in Latin America and other countries — the attackers have already stolen dozens of gigabytes and nearly 95,000 files.

Nov 18, 2025

Datami Newsroom

Datami at MERGE Madrid and EBC 25

The Datami team attended MERGE Madrid and the European Blockchain Convention 2025 to share their expertise and witness how Web3 is evolving. This year, the focus shifted toward real-world solutions – security, auditing, and transparent standards.

Nov 13, 2025 3 min

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.