Skip to content

Where the ledger lives, and who can reach it.

You are handing us your client’s books. That deserves a straight answer rather than a badge wall, so this page says what is in place today and nothing more.

What the system actually does.

Each record states one control as a buyer can read it, and names the part of the product it comes from. Nothing here describes work that is planned.

  1. Where the ledger is stored

    Client ledgers and uploaded documents are held in object storage in India. If your engagement terms need the residency stated in writing, ask and we will put it in the agreement.

    Evidence

    Object storage region in India

  2. Role-based access

    Firm admin, senior auditor and junior auditor each see only what their role permits, enforced on the server rather than hidden in the interface.

    Evidence

    Backend require_roles enforcement; frontend RoleGuard

  3. Every action is logged

    Who opened what, who reviewed a flag, who proposed an adjustment from one, and when — each recorded against the user who did it.

    Evidence

    Audit trail logging in the backend

  4. Session-based authentication

    Sign-in uses httpOnly cookies with short-lived access tokens and refresh rotation. No token is exposed to page scripts.

    Evidence

    Cookie-based JWT auth, access plus refresh

  5. Client portal is deliberately narrow

    Your client signs in to collect the signed report, and nothing else. Findings, flags and working papers are never visible to them — those reach a client through the engagement letter, not through software.

    Evidence

    Portal endpoints scoped to signed reports; separate portal identity

  6. Tenant isolation

    Every record is scoped to a firm. Another practice using the platform cannot see your work.

    Evidence

    Firm-scoped multi-tenancy across the data model

What we do not claim.

We hold no third-party security certification at this time. When one is awarded it will be named here with its scope and date, and not before.

Certifications held
None

Read the controls against your own file.

Bring the questions your firm has to answer about client data, and see where each one lands in the working system.