Security
AuditBull holds your risk program, so we hold ourselves to the standard we help you enforce. This page describes how customer data is protected today, in plain language. The companion documents are the Privacy Policy and the sub-processor list.
Architecture
The origin is private. Our servers have no public address. All traffic enters through Cloudflare's edge network and a private tunnel, with a web application firewall in front.
Every request proves itself. Each API request carries a cryptographically verified sign-in token. The application resolves your tenant from that token alone, never from anything the client asserts, and the database enforces the tenant boundary on every query as a second, independent layer.
Least privilege throughout. Application secrets live in Azure Key Vault. Database access runs on restricted roles. Staff administration happens on a separate, gated plane with corporate sign-in, restricted to a named staff group.
Data protection
Encryption. Data is encrypted in transit (TLS 1.2 or higher) and at rest (Azure-managed encryption).
An audit trail that can't be quietly edited. Significant actions are recorded append-only, with actor, timestamp, and reason. That record is the backbone of the product and of our own accountability.
Deletion you can verify. On a verified request, tenant data is deleted from live systems within 90 days; encrypted backups expire on a rolling schedule within 35 days after that. Audit records are pseudonymized rather than destroyed, preserving the integrity of your compliance history. Full details in the Privacy Policy.
Sub-processors
We use a deliberately small set of vetted, US-based providers: Microsoft (hosting, identity, Teams), Cloudflare (edge network), Stripe (billing), Clerk (sign-in), and Anthropic (AI-assisted features, only when a customer uses them). The current list, with what each processes, is always published at auditbull.com/subprocessors.
Where we are, honestly
AuditBull is an early-stage product built security-first: the controls above are architectural decisions, not roadmap items. Independent attestations are the part that takes time — SOC 2 examination and third-party penetration testing are planned and in motion. If your review needs a security questionnaire completed or architecture questions answered, we do that gladly: support@auditbull.com.
Reporting a concern
If you believe you've found a security issue, email support@auditbull.com with the details. We read every report and will respond promptly. Please don't test against tenants you don't own.