Security at AuditFront

Application data and uploaded audit evidence are hosted on infrastructure in Germany. Additional services support login, payments, email and the marketing website, and their processing locations differ.

See the sub-processor list for provider roles, data categories and locations, and the privacy policy for processing and transfer details. Hosting location alone does not establish GDPR compliance.

Data is encrypted in transit using TLS, and HTTPS is enforced for the public application and API. Database and evidence services are isolated and are not exposed as public application endpoints.

• All API and web traffic encrypted with TLS 1.2+ (HTTPS enforced)
• Database and evidence services isolated from public application traffic
• Automated TLS certificate renewal with zero-downtime rotation

Authentication uses an identity provider with OpenID Connect (OIDC), password hashing and role-based access controls.

• PKCE-based authentication flow (no client secrets in the browser)
• Google SSO integration for passwordless login
• Access controls separate each account's audit data
• API rate limiting to protect against brute-force and abuse

Our infrastructure runs on dedicated EU servers with containerized service isolation. Each component operates within its own isolated network, minimizing the blast radius of any potential security incident.

• Dedicated EU-hosted infrastructure (not shared multi-tenant cloud)
• Containerized services with isolated networking
• Automated CI/CD pipeline with test suite gating every deploy
• Staging environment for validation before production promotion

We maintain daily encrypted backups with a 30-day retention policy. Our infrastructure is designed for rapid failover and business continuity, with automated service recovery and health monitoring.

• Daily automated, encrypted database backups
• 30-day backup retention with verified restore procedures
• Automatic service recovery on failure

AuditFront is designed with data protection built in from day one. We operate under Polish and European Union law, and our payment processing is handled by a Merchant of Record, so we never directly store your payment card details. The application uses limited first-party funnel events without storing audit answers, evidence content, or filenames. It contains no advertising trackers or third-party analytics.

AuditFront provides tools for data export and account deletion. GDPR rights and any applicable exceptions are described in our privacy policy:

• Data export - download all your data in a portable format (GDPR Article 20)
• Account deletion - request account deletion, subject to the retention periods and exceptions in our privacy policy

We provide real-time service availability monitoring with a public status page. Our infrastructure includes automated health checks and alerting for rapid incident response.