How AuditGlass protects your organisation’s data, what is in place today and what is still in progress. Every line on this page maps to a control in our register.
01Compliance status
Stated plainly. We do not hold a certification today, and we will not say we do.
Audit planned for Q2 2027. Our 65 controls are mapped to the Trust Services Criteria: security, availability, confidentiality, processing integrity and privacy. We will share the report here, under NDA, once it is issued.
55 controls are built into the platform. 10 depend on people and paperwork and are in progress.
Our hosting, email, payments and AI providers hold their own SOC 2 Type II and ISO 27001 reports. We review them before onboarding and every year. These are their certifications, not ours.
See all 10 sub-processors02Security overview
Seven areas, each with the controls behind it. Items marked “In progress” depend on people or paperwork and are not finished yet.
Passwords of at least 12 characters, checked against known breached passwords.
IAM-01
Two-step sign-in with an authenticator app and 10 one-time recovery codes. Required for AuditGlass staff, panel experts and console users; organisations can require it for their team.
IAM-02
Five failed sign-ins in 15 minutes locks the account for 15 minutes and emails the account owner.
IAM-03
Role-based access with least privilege. Every client record is scoped to its own organisation, and cross-organisation reads are blocked and logged.
IAM-04 · IAM-05
Encrypted sessions with an idle time-out, and “sign out everywhere else” in Settings.
IAM-08
Every staff, expert and console account is reviewed each quarter; leavers lose access within 24 hours.
IAM-06 · IAM-07
TLS 1.2 or higher on every connection, with HSTS.
ENC-01
AES-256 encryption at rest, plus application-level encryption for answers, evidence and registers.
ENC-02
Storage keys held in a key management service; the application key is rotated yearly.
ENC-03
Integration secrets are stored encrypted and only ever shown as their last four characters.
ENC-04
Hosted in the EU. Files are encrypted before they’re stored.
PRV-08
Encrypted daily database backups, kept for 35 days in a second EU region (Frankfurt).
AVL-01
A backup is restored to staging every quarter and timed against a 4-hour recovery target. In progress
AVL-02
Uptime is checked every minute, with alerts on errors, queues and disk space, and a public status page.
AVL-03
Security headers on every response, rate limits on sign-in and exports, and uploads scanned before anyone can open them.
APP-01 · APP-03 · APP-04
Code changes go through reviewed pull requests; production is deployed only from tagged releases. In progress
CHG-01 · CHG-03
Dependency checks on every build, monthly patching and a yearly external penetration test. In progress
APP-05
An audit log of who did what, when and from where. Each entry is chained to the one before, so a missing or altered entry shows up when the chain is checked.
LOG-01
The audit log is kept online for 13 months, then archived for 6 years. Application logs are kept for 30 days.
LOG-02
Alerts for impossible travel, bulk exports, repeated lockouts and privilege changes.
LOG-03
Every view, download and share of evidence or vault documents is logged, and your organisation can see that log.
LOG-04
Eleven written policies covering security, access, encryption, logging, change, vendors, incidents, continuity, data protection and retention, reviewed every year. In progress
POL-01
Staff, admins and panel experts accept the policies on their first sign-in and every year after.
POL-02
Confidentiality terms are signed before access. Panel experts are vetted for qualifications, insurance and references.
POL-03 · POL-05
Yearly security and privacy training for staff and experts.
POL-04
Named owners: Rohab Brar for security and Kathy Horgan, our Data Protection Officer, for privacy. They review controls, risks and incidents every quarter.
GOV-01 · GOV-02
Names, emails, phone numbers, PPSN and NI numbers, addresses and IBANs are replaced before any text is sent to the AI provider.
AIX-01
Prompt logs are off by default. If switched on, they are deleted after 30 days.
AIX-01
AI drafts are labelled, and a person has to accept them before they reach you.
AIX-02
The AI provider (Anthropic) works under a data processing agreement with Standard Contractual Clauses. A DPIA covers AI drafting.
RSK-03 · PRV-08
A written incident plan with severity levels and named roles.
INC-01
Personal data breaches are assessed against the 72-hour deadline for telling the DPC, and affected customers are told without undue delay.
INC-01 · INC-02
Every security event is recorded and closed with lessons learned, whether or not it is reported.
INC-02
A yearly breach exercise with the whole team. In progress
INC-03
03Data and region
The app and database run in Dublin. Encrypted backups are kept in Frankfurt. Providers outside the EU only receive what they need, under the EU-US Data Privacy Framework or Standard Contractual Clauses.
Dublin
Encrypted, Frankfurt
Then archived 6 years
Then pseudonymised
04Documents
Ask for any document and we email it to you, usually within two working days.
Article 28 terms, Standard Contractual Clauses annex, security annex and the sub-processor list. You accept it when you create an organisation.
This page as a short PDF for your procurement or IT team, with the control IDs.
One page on each of our eleven policies: what it covers, who owns it, when it is reviewed.
Every provider that handles personal data for us: purpose, data, location and transfer safeguard.
What we collect, why, how long we keep it and your rights.
05Sub-processors
We tell customers at least 30 days before a new sub-processor starts handling personal data. You can object in that time, and if we can’t resolve it you can end the contract without penalty.
06Responsible disclosure
Tell us first. Email security@auditglass.ie with the steps to reproduce it. We confirm receipt and triage every report within 3 working days, and keep you updated until it is fixed.
We don’t run a paid bug bounty yet. APP-06
Please
Please don’t
We won’t take legal action against good-faith research that follows these rules.
Our Data Protection Officer is Kathy Horgan: privacy@auditglass.ie. You can also complain to the Data Protection Commission (Ireland) or, in the UK, the ICO.
14 live · 0 coming next14 audits · written for Ireland
Showing all 14 audits
Find my auditSix quick questions and we rank the audits for you.
No audits match “”
Try a framework (GDPR, NIS2, DORA), a topic like “photos” or “suppliers”, or another sector.