Security
AuditAI is built for auditors. Our own security posture is designed to hold up to the same questionnaires our customers run on their vendors. This page is the public reference; under NDA we share our current control inventory, our SOC 2 Type I report, and our SOC 2 Type II report when it is issued. Request from asarewilliam0@gmail.com.
Identity and access
Authentication, authorisation, and access-review controls for both customer users and our own production environment.
- Authentication via Clerk with mandatory MFA for platform-admin users.
- Enterprise SSO (SAML / OIDC) on the Enterprise tier.
- Role-based authorisation with closed enum (
viewer / contributor / admin / owner) plus per-engagement role overrides for self-audit conflicts. - Access reviews on each role change and at minimum quarterly cadence. Production access is least-privilege and time-boxed via just-in-time elevation.
Tenant isolation
Multi-tenant isolation is enforced at the database layer, not just the application - Row-Level Security on every table, verified continuously in CI.
- Postgres Row-Level Security on every public table, with
FORCE ROW LEVEL SECURITYso the table owner is also subject. - Per-request tenant context set via
SET LOCAL ROLE app_user+app.current_org_idsession variable; the connection drops back to a BYPASSRLS role only for explicit system-context jobs (Inngest cron, public trust aggregators). - Application-layer
auditorOrgId/clientOrgIdfilters remain in place as defense-in-depth alongside RLS. - Continuous verification:
scripts/verify-rls.tsruns in CI and asserts cross-tenant reads are blocked, INSERT spoofing is rejected, and system context bypasses RLS only as designed.
Data protection
Encryption at rest and in transit, with key rotation and credential isolation for stored integrations.
- TLS 1.2+ for data in transit; HSTS preloaded.
- AES-256 encryption at rest in Postgres and object storage (both Supabase).
- Stored integration credentials encrypted with AES-256-GCM: fresh 12-byte (96-bit) random IV per message, auth-tag verified on read, key versioning so a rotated key doesn't invalidate prior ciphertext.
- Bring Your Own Key (BYOK) available on Enterprise: integration credentials are encrypted with a per-blob DEK that is then wrapped by a KEK in your AWS KMS account. Disabling the KEK in your KMS immediately blocks all platform reads. GCP Cloud KMS and Azure Key Vault adapters are in development.
- Evidence files live in a private Supabase Storage bucket; signed-URL access only, no public reads.
Audit log integrity
The audit log is tamper-evident at the database layer and verifiable offline. Application bugs cannot rewrite it.
- Database-level
BEFORE UPDATE / DELETE / TRUNCATEtriggers reject mutations to theAuditLogtable. - Per-row
prevHash+rowHashSHA-256 chain for tamper-evidence beyond the trigger; a daily Inngest cron (audit-log-chain-verify) walks the chain, raises aSecurityIncidenton break, and the same check is reproducible offline withscripts/verify-audit-log-chain.ts. - External anchoring (Phase 27): SHA-256 Merkle root of each day's audit activity emitted to a sink you control (S3 bucket, HTTPS collector, GitHub gist). Tampering with the audit log requires also tampering with your own storage — which AuditAI cannot do.
- Verifiable CSV exports: every admin audit-log export bundles a
manifest.jsonwith the Merkle root + per-row chain hashes; the offline verifierscripts/verify-audit-log-export.tsreproves integrity without DB access. - Every mutation in the audited domain (Finding, ControlAssessment, Report, billing, tenant ops, impersonation) writes an audit row with actor, IP, user agent, and request id.
AI safety
Defences specific to the AI surface: prompt-injection isolation, citation validation, cost caps, and ZDR support.
- Prompt-injection defence: every untrusted input is wrapped in
<user_input>tags; competing tags are stripped before the request reaches Claude. - Citation guardrails: every NIST AI RMF subcategory, ISO 42001 Annex A clause, OWASP LLM ID, EU AI Act article, and MITRE ATLAS technique or tactic the model emits is cross-checked against the canonical catalog before reaching the auditor; hallucinated IDs are stripped silently. Free-form descriptive citations have no catalog to validate against.
- Per-tenant + per-engagement AI cost cap; runaway tenants are rejected with 429 before incurring further charges.
- Anthropic Zero Data Retention is supported via the
ANTHROPIC_ZDR_ENABLEDflag (requires enrollment in Anthropic's ZDR program); status is published on the Methodology page. - All AI-drafted findings, recommendations, and executive summaries are labelled in the rendered report; report cover pages disclose AI assistance.
- Public eval suite at /trust/evals with nightly classify-workflow pass-rates.
Operational security
Production hardening: signed webhooks, rate limits, upload caps, and a documented incident-notification commitment.
- Stripe webhooks: signature verification, replay protection, an override window for clock skew, and ordering checks for out-of-sequence events. Clerk webhooks are signature-verified with idempotency dedup.
- Rate limiting on every admin, integrations, and AI endpoint, plus evidence upload, surveys, sign-in, and checkout - distributed via Upstash Redis in production.
- Per-tier evidence size cap and content-type allowlist; streaming virus scan for files above 5 MB.
- 72-hour security-incident notification commitment per the DPA.
- Inngest endpoint signature-verified; production refuses unsigned invocations.
Vulnerability management
Dependencies are scanned on every merge; remediation SLAs are published and tracked.
- npm audit in CI blocks merges introducing CRITICAL CVEs.
- Dependabot security updates with weekly cadence.
- SLAs: critical 7 days · high 30 days · medium 90 days · low next maintenance window.
- Coordinated disclosure programme - see AUP.
Privacy and transparency
Customers can see when we (or our admins) access their tenant, export their data, or request erasure.
- Tenant-visible
AdminAccessHistorypanel showing every platform-admin impersonation session targeting the org, active and historical. Impersonation cookies are HMAC-signed andSameSite=strict. - Banner shown to non-admin tenant members during an active impersonation.
- GDPR Article 15 export at
/api/portal/data-export; right-to-erasure via in-app deletion request with 30-day grace period. - Live status of upstream services (Anthropic, Clerk, Stripe, evidence storage) at /trust/status.
Compliance roadmap
Current certifications and ongoing audit work. Each badge below reflects the actual status today, not a press-release aspiration.
Audit in progress. Type I report available under NDA.
Readiness assessment underway.
Gap assessment underway.
Not currently in scope. Customers must not upload PHI without an executed BAA.
Reach the security team
Three inboxes, each monitored. Use the right one and you'll reach the right person fastest.