Starfish Achieves TISAX® Assessment at Level 3 for Hellgate

Ulm, Germany — July 2026 — Starfish GmbH & Co. KG, the company behind Hellgate®, has successfully completed its first TISAX® assessment, achieving it directly at Assessment Level 3 (AL3), the most rigorous level the framework provides. The result confirms that Hellgate's information security is validated not only at the technical layer but across the organization's processes and workflows.

What TISAX is

TISAX® (Trusted Information Security Assessment Exchange) is the established standard for assessing information security in the automotive industry. It was developed by the ENX Association together with the German Association of the Automotive Industry (VDA) and is built on the VDA ISA catalogue, which is derived from ISO/IEC 27001 and ISO/IEC 27002 and extended with automotive-specific requirements. TISAX gives manufacturers, suppliers, and service providers a common, mutually recognized way to demonstrate that they handle sensitive information securely, removing the need for repeated, duplicated audits between partners.

What the assessment involves

A TISAX assessment is carried out by an ENX-accredited audit provider against a defined scope and one or more assessment objectives. Starfish was assessed under Scope-ID S36H7T against three objectives:

• Data Protection according to EU-GDPR Art. 28 ("Processor")

• Very High Availability

• Strictly Confidential

The assessment examined our information security management system (ISMS) and the controls governing how information is collected, stored, and processed.

What Level 3 means

TISAX defines three assessment levels that determine how deeply an organization is audited, based on the protection needs of the information involved. Level 3 is the most demanding: it is required for data with a very high need for protection, such as strictly confidential or secret information. Unlike a remote review, AL3 requires a full on-site audit by an accredited auditor, including in-person interviews with control owners and verification that security controls are not only documented but actively functioning as intended. It is an exhaustive check of the entire ISMS.

This assessment complements our existing PCI DSS Level 1 certification, the highest standard for securing payment card data. Where PCI DSS secures our technical systems, TISAX now additionally confirms that our organizational processes and workflows meet equally high requirements.

What this means for our customers and partners

For customers and partners, the result means greater reliability and transparency in working with us. It provides independent, external confirmation that Hellgate maintains high availability, treats information as strictly confidential, and processes personal data in line with GDPR requirements. As a small company, we deliberately hold ourselves to this standard, and this result demonstrates that scale is no barrier to operating at the front of the field on security.

How to verify our TISAX status

TISAX is a closed community of trust, and results are shared only among TISAX participants rather than with the general public. Participants can retrieve our assessment result directly through the ENX Portal by searching for our Scope-ID S36H7T on the Published and Shared Results page.

ENX Portal: https://portal.enx.com/en-US/TISAX/tisaxassessmentresults/

If you are not yet a TISAX participant or cannot locate the result, please reach out to your Hellgate contact and we will share it with you directly.

About Starfish and Hellgate

Starfish GmbH & Co. KG is the company behind Hellgate®, a Composable Payment Architecture (CPA) platform. Hellgate helps organizations orchestrate payments, secure sensitive payment data, and manage fraud across a modular, standards-based infrastructure.