Trust
Where the ledger lives, and who can reach it.
You are handing us your client’s books. That deserves a straight answer rather than a badge wall, so this page says what is in place today and nothing more.
In place today
What the system actually does.
Each record states one control as a buyer can read it, and names the part of the product it comes from. Nothing here describes work that is planned.
-
Where the ledger is stored
Client ledgers and uploaded documents are held in object storage in India. If your engagement terms need the residency stated in writing, ask and we will put it in the agreement.
EvidenceObject storage region in India
-
Role-based access
Firm admin, senior auditor and junior auditor each see only what their role permits, enforced on the server rather than hidden in the interface.
EvidenceBackend require_roles enforcement; frontend RoleGuard
-
Every action is logged
Who opened what, who reviewed a flag, who proposed an adjustment from one, and when — each recorded against the user who did it.
EvidenceAudit trail logging in the backend
-
Session-based authentication
Sign-in uses httpOnly cookies with short-lived access tokens and refresh rotation. No token is exposed to page scripts.
EvidenceCookie-based JWT auth, access plus refresh
-
Client portal is deliberately narrow
Your client signs in to collect the signed report, and nothing else. Findings, flags and working papers are never visible to them — those reach a client through the engagement letter, not through software.
EvidencePortal endpoints scoped to signed reports; separate portal identity
-
Tenant isolation
Every record is scoped to a firm. Another practice using the platform cannot see your work.
EvidenceFirm-scoped multi-tenancy across the data model
Certifications
What we do not claim.
We hold no third-party security certification at this time. When one is awarded it will be named here with its scope and date, and not before.
- Certifications held
- None
A clearer practice
Read the controls against your own file.
Bring the questions your firm has to answer about client data, and see where each one lands in the working system.