Security Statement

Our commitment to protecting your information

AuditProo is a cloud-based audit management and financial reporting platform. We recognise that audit firms work with confidential client records, financial information, audit evidence and working papers. Protecting that information is fundamental to the trust placed in our platform.

Our security approach is built around confidentiality, integrity and availability. We apply technical and organisational safeguards appropriate to the information processed and the risks associated with the service.

What our security programme covers

1. Account and access security

Access to AuditProo should be limited to authorised users. User accounts and permissions are intended to support accountability and role-appropriate access. Customers should assign permissions carefully, remove access when users leave or change responsibilities and protect their login credentials.

2. Separation of customer information

Customer environments must be logically separated so that users of one firm cannot access another firm's audit files or records. Access to customer information by AuditProo personnel should be limited to authorised operational, support, security or maintenance purposes and governed by appropriate safeguards.

3. Data protection in transit and at rest

AuditProo's security design calls for protection of information while it is transmitted between users and the platform and while it is stored. Encryption technologies, secure communication protocols and controlled access to encryption credentials should be used in accordance with the platform's technical architecture.

4. Infrastructure and application security

The platform's infrastructure and application should be maintained through secure configuration, access restrictions, software updates, vulnerability management, security testing and controlled production changes. Development, testing and production activities should be appropriately separated.

5. Backup, recovery and availability

AuditProo recognises the importance of access to audit files throughout the audit cycle. Backup and recovery arrangements should protect against accidental loss, system failure and disruptive incidents. Restoration procedures should be tested periodically.

6. Monitoring and incident response

Security events should be monitored and investigated using appropriate system records. Suspected incidents involving customer information should be assessed, contained, investigated and communicated to affected customers or authorities where required by law or contract.

7. Employee and service provider responsibilities

People who may access customer information should be subject to confidentiality obligations and appropriate access restrictions. Third-party providers that process information should be assessed and engaged under suitable contractual and security requirements.

AI and customer information

AuditProo uses or may use artificial intelligence to support audit and financial reporting workflows. Customer information submitted for AI processing must be handled in accordance with the applicable customer agreement, privacy commitments and documented processing arrangements. Customer information should not be used to train general-purpose or third-party models unless there is an appropriate legal basis and the required customer authorisation. AI service providers should be assessed and contractually bound to suitable safeguards.

Your role in keeping information secure

• Give each team member an individual account. Avoid shared credentials.
• Use strong passwords and multi-factor authentication where available.
• Assign access according to each person's role and responsibilities.
• Remove access promptly when a team member leaves or no longer needs it.
• Protect devices used to access AuditProo and keep them updated.
• Report suspected account compromise or unusual activity promptly.

Security documentation and enquiries

AuditProo maintains internal security governance documentation, including an Information Security Policy. Customers requiring further information about security controls, data processing or assurance arrangements may contact AuditProo through its designated support or business contact channel.