Data Processing Agreement

Auditara Ltd will process Customer Personal Data only on the Customer's documented instructions as provided through the platform interface.

All personnel with access to Customer Personal Data are subject to confidentiality obligations and receive appropriate data protection training.

Auditara Ltd implements the following technical and organisational measures:

• Encryption in transit (TLS) and at rest for all stored data and files.
• Row-level security in the database preventing cross-account data access.
• Private storage bucket for evidence files, accessible only by the account owner.
• Google sign in, or email and password with credentials stored only as salted hashes by our authentication provider.
• EU West data residency for all Customer Personal Data.
• Automated database backups managed by our hosting and database provider.
• Uptime monitoring of the application.

Auditara Ltd engages sub-processors to provide the Service. The Sub-processor List, naming each sub-processor, its purpose and its processing location, is available on request at security@auditara.io. It is provided to customers and to prospective customers evaluating Auditara.

Every revision of the Sub-processor List carries a revision number and a date, and each copy issued states them. The revision current at the date of this agreement is Revision 1, 6 September 2026. The revision you hold is the baseline against which any addition or replacement under this clause is measured, so you can compare a notice to the list it changes.

Safeguards for Mistral AI SAS, our AI sub-processor: requests are sent server side to Mistral’s EU endpoint, api.eu.mistral.ai, using the models mistral-small-latest and mistral-medium-latest, and the sub-processor is engaged only when the customer enables AI assistance. Inputs and outputs sent to that sub-processor are retained under its own published data processing terms for stateless API calls, which include automated moderation and abuse monitoring of its APIs. Auditara Ltd has not requested zero data retention from that provider and does not claim it. No retention period is stated here, because Auditara Ltd states only what it has verified in the provider’s published terms.

Where the Customer enables AI assistance, Auditara transmits control reference text, Customer typed notes and statuses, and Customer provided intake answers to Mistral AI SAS for the sole purpose of generating draft text. Uploaded evidence files are never transmitted. Processing runs server side against Mistral’s EU endpoint.

Auditara Ltd will provide at least 30 days notice before adding or replacing any sub-processor that processes Customer Personal Data. Notice is given against the most recent revision of the Sub-processor List issued to you: it names the sub-processor being added or replaced, its purpose and its processing location, identifies the revision it supersedes, and states the revision number and date it creates. The 30 days run before the change takes effect, not after. You may object within that period by emailing hello@auditara.io.

Auditara Ltd will assist you in responding to data subject rights requests including access, rectification, erasure, and portability. Requests should be sent to hello@auditara.io and will be fulfilled within 30 days.

In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Auditara Ltd will notify you within 48 hours of confirmation, providing details of the breach, the data affected, and the steps being taken to address it. You remain responsible for notifying the ICO within 72 hours where required under UK GDPR Article 33.

On termination of your subscription or on request, all Customer Personal Data will be permanently deleted within 30 days. Anonymised billing records are retained for 7 years as required by HMRC. Written confirmation of deletion is available on request.

You may request evidence of Auditara Ltd's compliance with this DPA by emailing hello@auditara.io. Formal on-site audits may be conducted with 60 days advance written notice, no more than once per year, at the Customer's cost unless non-compliance is confirmed.