Security at Auditara
We would rather show you the test than tell you the outcome. Everything below is something we ran, with the method stated, so you can judge it rather than take it.
An external vulnerability assessment of Auditara, carried out by Intruder on 6 September 2026, returned no findings across 46,368 checks. Intruder is CREST accredited and Cyber Essentials certified. Assessment is scheduled monthly, with emerging threat scans in between.
Every table is governed by row level security, 217 policies across 84 tables. We prove isolation with a suite that builds its own database from our schema, seeds two separate tenants, and confirms as an unprivileged user that neither can reach the other's data. It carries a vacuity control, so a table nobody can read cannot pass simply by being unreachable.
When a document is approved in Auditara, its content is frozen in the database. We tested that by trying to break it. Editing an approved section, deleting one, reverting an approved document to draft, and deleting a frozen version snapshot were each refused. Editing a draft was allowed, which is what proves the controls discriminate rather than blocking everything.
We have restored our schema end to end into a clean database and verified it by counting at source: tables, policies, functions and triggers. The controls protecting approved evidence were confirmed to survive the rebuild and to still fire.
Auditara's database and file storage run in the European Union, in Ireland. Data is encrypted in transit and at rest.
Schema changes are written as migrations, rehearsed against a separate environment carrying an identical schema, and verified before they reach production. Type checks and a build run on every change and block it from merging if they fail.
If you believe you have found a security issue in Auditara, write to security@auditara.io. We will acknowledge your report and keep you updated while we investigate. We will not pursue action against anyone reporting in good faith.
Our current sub-processor list and Data Processing Agreement are available on request at security@auditara.io.