Security & data protection
The auditor is built for operational teams who are careful about what they paste into a tool. Here is exactly how your information is handled.
Encrypted in transit and at rest
Every request runs over HTTPS with HSTS enforced, so browsers refuse to downgrade to an insecure connection. Data is stored on managed Postgres infrastructure with encryption at rest.
Your audits are visible only to you
Row-level security is enforced in the database itself: each report row is bound to your user ID, and the database rejects any read or write from another account — even if application code were bypassed. Anonymous visitors have no read access to the reports table at all.
Never used to train AI models
Process descriptions are sent to the analysis model only to generate your report. They are not used to train models and are not shared with third parties for any other purpose.
Sharing is off by default
A report is private until you explicitly create a share link. Links use signed, tamper-proof tokens with an optional expiry date, and you can revoke every issued link for a report instantly.
Password-protected links with brute-force defence
Share links can require a password or one-time code. Passwords are hashed with PBKDF2 and never stored in readable form, the hash is never exposed to the browser, and repeated failed attempts trigger a CAPTCHA challenge.
Delete anything, permanently
Deleting a report removes it from the database immediately, including any share links pointing at it. We only ask for an email address for your account — no other personal data is required to use the auditor.
Good practice when describing a process
The audit works from the shape of your workflow — steps, hand-offs, tools and timings. You do not need to include customer names, contact details, financial account numbers or other personal data, and we recommend leaving them out.