Beyond the physical key: how we test the cloud behind your vending fleet

An independent penetration test of our cloud platform: what it covered, how the fixes were verified, and five questions you can ask any provider

A vending machine used to be secured with a key. That key still matters. Today, a price change made in your fleet platform can reach machines across many sites. A customer who pays through a mobile app relies on cloud services to complete the purchase.

More of your fleet's security now sits in the cloud platform behind your machines. Your prices, payments, user access and consumer data all run through it. For a fleet, that comes down to three practical questions. Can another business on the same platform see or change your data? Can someone take over one of your accounts? Can someone without the right access change prices or machine configuration?

If you run or secure a fleet, a general promise of safety tells you very little. You need to know what was tested, who tested it and how the results were checked. Below, we set that out for our platform. We close with five questions you can put to any provider, including us.

Why we commissioned an independent assessment

We expanded into new markets and onboarded larger clients. At that stage, we commissioned an independent penetration test and security assessment of our cloud platform. A penetration test is an authorized, simulated attack. It looks for weaknesses so they can be fixed before anyone else finds them.

Accedia's cybersecurity team carried out the work over about 20 calendar days between February and March 2026. Accedia is a European software engineering and IT services company headquartered in Sofia, Bulgaria. Its engineers also work with ours on parts of the platform, as Accedia describes in its published case study. The assessment itself was the work of Accedia's cybersecurity specialists.

Two services your business relies on

The scope covered two parts of the platform you work with directly:

• the cloud management API behind Luna, our automated retail platform, which you use to manage machines, prices and user access across your fleet
• the public Wallet API, which mobile apps use for payments, loyalty and purchase history

Tested from outside and from inside an account

Accedia approached the platform from two starting points. In black-box testing, the team acted as an external attacker with no access and looked for a way in. In grey-box testing, it acted as a logged-in user with limited permissions. It then checked whether that account could reach further than its role allows.

The reference frameworks were the OWASP Top 10 for web applications and the OWASP IoT Top 10. Both are widely used industry lists of the most critical security risks.

The assessment focused on these two cloud services, where your fleet data, prices and payments are managed. We describe its results only within that scope.

Fixes verified by Accedia in a retest

A penetration test is designed to find weaknesses. What matters is how they are handled afterwards. Our engineers remediated the issues the assessment identified. Accedia then ran a retest and independently verified the fixes.

The detailed report and the individual findings stay confidential. Keeping them private protects the platform and every business that runs on it.

A test is a snapshot, so the work continues

A penetration test describes a platform at one point in time. Software changes, and so do the methods attackers use. That is why we repeat independent testing regularly. Between tests, our security work continues through:

• role-based access management, so each person on your team sees and changes only what their role requires
• secure software updates
• monitoring

"A vending machine is only as secure as the cloud platform behind it. That's why we had our platform independently tested by Accedia, had the fixes re-verified, and keep testing. Our customers trust us with their fleets, payments and consumer data, and protecting that trust is part of the product."

— Doichin Yordanov, CTO, Invenda Group AG

Five questions to ask any vending platform provider

Use them when you compare platforms, or to review the one you already run. The answers show you what a security claim is based on.

1. When were your cloud services last tested, and who carried out the test?
2. Which services and APIs were in scope, and what was left out?
3. Did the testing cover both an outside attacker and a logged-in user with limited access?
4. Which reference frameworks, such as the OWASP Top 10, guided the testing?
5. How were the fixes verified, and when is the next test planned?

Ask us the same five questions

To go through these questions for Invenda, contact our team. We will walk you through how we test and maintain the security of the platform behind your machines.

Let's talk →

‍