Question: There is a website my company uses for personal data provided by a second party. In the password creation page it is possible to create a 30-character password, but attempting to login with this password throws an invalid password error. Using shorter passwords are possible.

Should my company be concerned? Is this indicative of deeper flaws in their security?

Answer: 
Obviously whoever built this was not very good at what they were doing and/or not really paying much attention to detail. When working with security critical things like authentication, that's not great.

Think of it like this: If you found that your electricity guy had accidentally installed the outlet sockets upside down, that in itself isn't the end of the world. But wouldn't it make you a little bit worried that he messed up something else more critical and your house will burn down?

Also, [short limits to password length](https://security.stackexchange.com/questions/33470/what-technical-reasons-are-there-to-have-low-maximum-password-lengths) might be an indicator of a legasy system with no or bad hashing. Even worse, as [jrtapsell](https://security.stackexchange.com/users/159064/jrtapsell) highlights, the fact that the password is accepted when set but not at logg in could be a sign that it is truncated when inserted into the database and hence stored in plaintext.

So while this is proof of nothing, it should still set off your alarm bells.
I dont believe it is possible to draw conclusions about the whole system from this error. 
I do think this is an issue that can be solved and should be solved.

It might be wise to do some research on the security, but I think you can't draw good conclusions with just this information.