Information Security Policy

Policy statement

This policy establishes the information security framework governing the development, operation and management of AuditProo, a cloud-based audit management and financial reporting platform serving audit firms and accounting professionals.

The policy is designed to achieve five objectives:

• Confidentiality: Protect client information, audit working papers, financial records and other sensitive information from unauthorised access or disclosure.
• Integrity: Ensure that information processed and stored in AuditProo remains accurate, complete and protected against unauthorised alteration.
• Availability: Ensure that authorised users can access AuditProo and their information when required.
• Accountability: Establish clear responsibility for protecting information and managing security risks.
• Regulatory compliance: Protect personal data and comply with applicable data protection, privacy and other regulatory requirements.

This policy is written as a formal organisational policy suitable for internal adoption and use as part of AuditProo's customer assurance documentation. It does not imply that AuditProo has already implemented every control described. Actual technical implementation and supporting evidence should be verified before making security representations to customers.

1. Purpose and scope

This policy applies to:

• AuditProo's cloud application, databases, infrastructure and supporting systems.
• Customer information uploaded, generated, processed or stored through the platform.
• Audit working papers, audit evidence, trial balances, financial statements and supporting schedules.
• Personal information relating to customers, their employees, clients, suppliers and other stakeholders.
• AuditProo employees, contractors, consultants, administrators and third-party service providers who have access to company or customer information.
• Software development, testing, deployment, maintenance and technical support activities.

All persons within the scope of this policy are required to comply with its provisions.

2. Information security principles

AuditProo shall adopt the following principles:

• Confidentiality: Customer information shall only be accessible to authorised individuals for legitimate business purposes. Customer information shall not be disclosed to other customers or unauthorised third parties.
• Integrity: AuditProo shall implement appropriate safeguards to prevent unauthorised modification, deletion, corruption or manipulation of customer information.
• Availability: The platform shall be designed and maintained to provide reliable access to authorised users. Appropriate backup, recovery and continuity arrangements shall be maintained.
• Least privilege: Users and employees shall receive only the access privileges necessary to perform their assigned responsibilities.
• Security by design: Security considerations shall be incorporated into the design, development, deployment and maintenance of AuditProo rather than treated as an afterthought.

3. Data classification and protection

AuditProo recognises that audit and financial information is particularly sensitive because it may contain commercially confidential information, personal data and information relating to financial transactions.

4. Access control and user authentication

AuditProo shall implement access management controls to prevent unauthorised access to the platform and customer information.

1. Every user shall have an individually identifiable account. Shared user credentials shall not be permitted.
2. User authentication shall require appropriate login credentials.
3. Multi-factor authentication (MFA) shall be implemented for privileged accounts and administrative access, with broader availability encouraged.
4. Passwords shall meet defined complexity and security requirements.
5. Repeated unsuccessful login attempts shall trigger appropriate security safeguards.
6. User sessions shall expire after an appropriate period of inactivity.
7. Access rights shall be assigned according to user roles and responsibilities.
8. Administrators shall have access only to the functions necessary for their responsibilities.
9. Access rights shall be reviewed periodically and whenever an employee changes roles or leaves the organisation.
10. Accounts belonging to terminated employees or users whose access is no longer authorised shall be disabled promptly.

4.1 Customer account isolation

AuditProo shall maintain logical separation between customer organisations and their respective information. A customer shall not be able to access the information, audit files, working papers or financial records of another customer unless expressly authorised through an approved sharing arrangement.

4.2 Privileged access

Access to production infrastructure, databases and administrative functions shall be restricted to designated personnel. Privileged activities shall be logged and periodically reviewed.

5. Data encryption and secure transmission

AuditProo shall use encryption safeguards to protect customer information against unauthorised access or disclosure.

• Data transmitted between users and AuditProo shall be protected using secure communication protocols such as HTTPS with TLS.
• Sensitive information stored within databases and file storage shall be encrypted at rest.
• Encryption keys shall be appropriately protected and access restricted.
• Credentials, API keys and other authentication secrets shall not be stored in plain text.
• Sensitive information shall not be transmitted through unsecured communication channels.
• Backups containing customer information shall receive protection appropriate to the sensitivity of the underlying information.

Encryption arrangements shall be reviewed periodically to ensure they remain appropriate to prevailing security standards.

6. Customer data ownership and confidentiality

AuditProo recognises that customer information belongs to the respective customer or other lawful rights holder.

1. AuditProo shall not claim ownership of customer audit files, financial records or other customer-generated information.
2. Customer information shall only be processed for purposes connected with the provision of AuditProo services or as otherwise lawfully authorised.
3. AuditProo employees shall be bound by confidentiality obligations.
4. Customer information shall not be disclosed to another customer.
5. Customer information shall not be sold, rented or commercially exploited.
6. Access by technical support personnel shall be restricted to legitimate support, security or maintenance requirements.
7. Where support access to customer information is necessary, appropriate authorisation and safeguards shall apply.

6.1 Use of artificial intelligence

AuditProo incorporates or may incorporate artificial intelligence capabilities to support audit procedures and financial reporting. The following requirements shall apply:

• Customer information submitted for AI processing shall be handled in accordance with the applicable customer agreement and privacy commitments.
• AI processing shall take place only through approved systems and authorised service providers.
• Customer information shall not be used to train publicly available or third-party AI models without the necessary legal basis and customer authorisation.
• AI service providers shall be subject to appropriate confidentiality, security and data processing requirements.
• AI-generated outputs shall be made available only to authorised users within the relevant customer environment.
• AI processing shall not override customer access restrictions or tenant separation controls.
• Sensitive information shall not be included in AI prompts or external integrations unless necessary for the authorised task and protected by appropriate safeguards.

7. Data backup and recovery

AuditProo shall maintain backup and recovery arrangements designed to protect customer information against accidental deletion, system failure, cyberattacks and other disruptive events.

1. Regular automated backups of critical databases and customer information.
2. Appropriate protection of backup files through encryption and restricted access.
3. Secure storage of backup copies separately from primary production systems where practicable.
4. Defined backup retention periods.
5. Periodic restoration tests to establish that backed-up information can be recovered.
6. Documented procedures for restoring services following a major disruption.

AuditProo shall establish and periodically review recovery objectives, including:

• Recovery Time Objective (RTO): the maximum acceptable time required to restore critical services.
• Recovery Point Objective (RPO): the maximum acceptable period of data loss measured from the time of the disruption.

Specific recovery commitments shall be communicated to customers where included in the applicable service agreement.

8. Infrastructure and network security

AuditProo shall maintain appropriate security controls over the infrastructure supporting the platform.

• Secure configuration of servers, databases and cloud infrastructure.
• Firewall and network access restrictions.
• Protection against malware, malicious code and unauthorised system access.
• Regular security updates and vulnerability remediation.
• Monitoring of infrastructure performance and security events.
• Restriction of access to production environments.
• Periodic vulnerability assessments.
• Security testing before significant production releases.

Where third-party cloud infrastructure providers are used, AuditProo shall assess their security arrangements and contractual commitments.

9. Software development and application security

Security shall be considered throughout the AuditProo software development lifecycle.

• Secure coding: Developers shall follow secure coding practices designed to minimise common application vulnerabilities.
• Development and production separation: Development, testing and production environments shall be appropriately separated. Live customer data shall not be used in development or testing environments unless specifically authorised and adequately protected.
• Code review: Material application changes shall undergo appropriate review before deployment.
• Vulnerability management: Identified software vulnerabilities shall be assessed according to their severity and addressed within defined remediation periods.
• Release management: Changes to the production application shall follow an authorised deployment process, including testing and appropriate rollback arrangements.
• Third-party components: External software libraries, frameworks and integrations shall be assessed for security risks and maintained through appropriate updates.

10. Security monitoring and audit logs

AuditProo shall maintain appropriate logging and monitoring capabilities to support security oversight and incident investigation. Where technically supported, logs shall capture:

• Successful and unsuccessful login attempts.
• User account creation and modification.
• Changes to user permissions and access rights.
• Administrative activities.
• Access to sensitive system functions.
• Material changes to customer information.
• Security alerts and system errors.
• Relevant data exports and downloads.

Logs shall be protected against unauthorised modification and deletion. Access to security logs shall be restricted to authorised personnel. Logs shall be retained for a defined period consistent with operational, contractual and regulatory requirements.

11. Data retention and secure disposal

AuditProo shall retain customer information only for as long as necessary to fulfil the relevant service, contractual, legal and regulatory requirements.

1. Customer access shall be managed in accordance with the applicable subscription agreement upon expiry or termination of a subscription.
2. Customers shall be provided with a reasonable opportunity to export their information where the service agreement permits.
3. Customer information shall be deleted or returned in accordance with contractual instructions and applicable law.
4. Information held in backups shall be removed in accordance with the applicable backup retention and deletion cycle.
5. Information retained to meet legal obligations shall remain appropriately protected.

Secure deletion procedures shall be implemented to prevent unauthorised recovery of information where technically practicable.

12. Third-party service providers

AuditProo may engage third-party service providers to support hosting, infrastructure, payment processing, AI functionality, communications, analytics and other operational requirements.

Before engaging a provider that may access or process customer information, AuditProo shall consider:

• The provider's security policies and technical safeguards.
• Its data protection and confidentiality commitments.
• The nature and location of data processing.
• Its incident management arrangements.
• Its access control and infrastructure security.
• Its subcontracting arrangements.
• Its business continuity and recovery capabilities.

Appropriate contractual safeguards shall be established, including confidentiality and data processing obligations. Third-party access shall be limited to what is necessary for the services being provided.

13. Data protection and regulatory compliance

AuditProo shall operate its data protection framework in accordance with applicable data protection and privacy laws.

AuditProo shall assess its obligations as a data controller, data processor or both depending on the nature and purpose of each processing activity.

14. Security incident and data breach management

AuditProo shall maintain an incident response framework to identify, report, investigate, contain and resolve information security incidents.

Security incidents may include unauthorised access to customer accounts, suspected compromise of user credentials, exposure of customer financial information, malware or ransomware attacks, unauthorised disclosure of audit working papers, loss or corruption of customer information, compromise of cloud infrastructure, unauthorised access to production databases and incidents involving third-party service providers.

14.1 Incident response procedure

Upon identifying a suspected security incident, AuditProo shall:

1. Record and classify the incident.
2. Assess its nature, severity and potential impact.
3. Contain the incident to prevent further exposure or damage.
4. Investigate the cause and identify affected systems and information.
5. Implement corrective and recovery measures.
6. Notify affected customers and relevant authorities where legally required.
7. Document the incident and the actions taken.
8. Implement measures to prevent recurrence.

14.2 Breach notification

Where AuditProo acts as a data processor, it shall notify the relevant data controller without delay and, where reasonably practicable, within 48 hours of becoming aware of a personal data breach.

14.3 Incident register

AuditProo shall maintain an incident register documenting the date and nature of the incident, systems and information affected, potential impact, root cause where established, containment and remediation measures, notifications made and preventive actions implemented.

15. Business continuity and disaster recovery

AuditProo recognises that service availability is critical to audit firms, particularly during audit completion and financial reporting periods. The company shall maintain business continuity and disaster recovery arrangements designed to minimise disruption.

These arrangements shall address infrastructure or hosting provider failures, cybersecurity incidents, database corruption or loss, prolonged service interruptions, loss of access to critical operational systems and failure of essential third-party service providers.

Business continuity and recovery arrangements shall be periodically reviewed and tested.

16. Employee and contractor security responsibilities

All employees and contractors with access to AuditProo systems or information shall:

1. Maintain the confidentiality of customer information.
2. Use authorised devices, applications and communication channels.
3. Protect passwords and authentication credentials.
4. Avoid sharing access credentials.
5. Report suspected security incidents immediately.
6. Avoid downloading or copying customer information unless authorised.
7. Follow established access control procedures.
8. Participate in relevant security awareness training.
9. Comply with confidentiality agreements.
10. Return or securely dispose of company information upon termination of engagement.

Failure to comply with this policy may result in disciplinary or contractual action.

17. Customer security responsibilities

While AuditProo is responsible for protecting its platform and the information entrusted to it, customers also have responsibilities in maintaining the security of their accounts. Customers are expected to maintain the confidentiality of login credentials, assign access rights appropriately, disable accounts belonging to former employees, use strong passwords and MFA where available, avoid sharing user accounts, protect devices used to access AuditProo, notify AuditProo promptly of suspected account compromise and ensure information uploaded to the platform is lawfully obtained and authorised for processing.

18. Security assessments and continuous improvement

AuditProo shall periodically assess the effectiveness of its information security arrangements. Assessments shall consider emerging cybersecurity threats, identified system vulnerabilities, changes in technology and infrastructure, security incidents and lessons learned, customer feedback and security concerns, regulatory and contractual developments and changes to the nature and sensitivity of information processed.

Where necessary, AuditProo shall implement improvements to its security controls and procedures.

19. Policy violations

Any breach of this policy shall be investigated and addressed appropriately. Depending on the nature and severity of the violation, corrective measures may include suspension or withdrawal of system access, mandatory security retraining, disciplinary action, contractual remedies and reporting to relevant authorities where required by law.

20. Policy ownership and review

The responsibility for implementing and maintaining this policy rests with AuditProo management. Management shall ensure that appropriate security responsibilities are assigned, the policy is communicated to relevant personnel, required security controls are implemented, security risks are periodically assessed and the policy is reviewed at least annually and whenever material changes to the platform, operating environment or applicable regulatory requirements arise.