Three years of security testing for an eQMS that auditors have to trust

Websitekintavo.com ↗

Client

Kintavo

Industry

Regulated SaaS · eQMS & compliance

Engagement

Ongoing · 3+ years

QA team

2 security test engineers

Platforms

Websites · API · Cloud · Database

About the project

Kintavo runs the quality system of regulated organizations on one connected platform: document control with e-signatures, training records, CAPAs, deviations, audits, calibration and more — nineteen modules on a single data model, with a shared AI engine and one immutable audit trail. Its users are quality teams in blood centers, hospitals, laboratories and other regulated environments.

In an eQMS, a security failure is a compliance failure. A broken access rule can expose controlled documents, a tampered audit trail undermines 21 CFR Part 11 and GxP evidence, and a leaked record can carry sensitive patient- or donor-related data. The platform runs on a MEAN stack (MongoDB, Express, Angular, Node.js) with Go services, RabbitMQ messaging, Redis caching, Socket.io real-time updates and PostgreSQL — each with its own attack surface.

QAonTOP provides two dedicated security test engineers who run continuous security testing, vulnerability assessment and penetration testing release by release under agreed rules of engagement, and verify the compliance-critical controls regulated customers depend on.

What made this hard

Kintavo sells trust to quality teams and their auditors. Every release had to prove that records stay controlled, signatures stay attributable and the audit trail stays untouchable — across a stack with many moving parts.

1. CHALLENGE 01

   Audit trails must be tamper-proof

   21 CFR Part 11 and EU Annex 11 expect secure, time-stamped audit trails and attributable e-signatures. Any path that edits or bypasses them is a critical finding, not a minor bug.

2. CHALLENGE 02

   Fine-grained, multi-tenant access

   Roles, sites, modules and document states combine into thousands of permission paths. Each needed checking for privilege escalation and cross-tenant data exposure.

3. CHALLENGE 03

   A polyglot, event-driven stack

   Node.js and Go services talk over RabbitMQ, cache in Redis and push updates through Socket.io. Queues, sockets and caches are easy to miss in a web-only pen test.

4. CHALLENGE 04

   AI features add a new attack surface

   AI-assisted drafting and analysis read controlled records. Prompt injection or over-broad retrieval could reveal content a user is not permitted to see.

How QAonTOP tested Kintavo

1. 01

   Threat-model the platform

   Mapped assets, trust boundaries and data flows across the Angular front end, Express and Go APIs, message queues, caches and databases, then ranked them by regulatory impact: audit trail, e-signatures, controlled documents and tenant isolation first.

   Tools  SANS 25

2. 02

   Automated scanning every release

   OWASP ZAP scans authenticated web and API flows in staging on each release. Nessus scans cloud hosts and services, and Nmap maps exposed ports after infrastructure changes. Findings are triaged against the SANS Top 25 and OWASP Top 10.

   Tools  OWASP ZAP · Nessus · Nmap

3. 03

   Manual penetration testing

   Engineers test what scanners miss: broken object-level authorization on APIs, role and tenant escalation, e-signature and approval-workflow bypass, and audit-trail tampering. Confirmed issues are exploited in a controlled way with Metasploit to prove real impact.

   Tools  Metasploit · OWASP ZAP

4. 04

   Test the event and data layers

   RabbitMQ queue permissions and message injection, Socket.io authentication and channel isolation, Redis exposure and cache poisoning, and injection and access controls on MongoDB and PostgreSQL.

   Tools  RabbitMQ · Socket.io · Redis · MongoDB · PostgreSQL

5. 05

   Verify, retest and report

   Every finding gets a severity, reproduction steps and fix guidance, and is retested before closure. Compliance-critical controls — audit trail, e-signatures, access — are re-verified each cycle, which ends with a report Kintavo can share with customer security and quality reviewers.

   Tools  Nessus · OWASP ZAP

The engagement in numbers

Before and after the engagement

What we covered