Your data & security

Auditaar checks public webpages, so you do not need to connect website admin, analytics or advertising accounts. The information it holds covers your account details, orders and audit results. This page sets out how the service is secured and how to reach the security contact.

What protects your data

Security built into the service.

The data Auditaar holds

Account and order data: your name and email, the URLs you submit, the reports Auditaar generates, and a record of each payment (no card numbers).
Usage data: optional analytics you can switch off in Cookie settings at any time. Server logs are kept separately to operate the service.
No access to your site's servers, analytics or private accounts. Auditaar reads only what is public.

Encryption

All traffic is served over TLS 1.2 and 1.3.
Off-site backups are encrypted before they leave the server, then stored on Cloudflare R2.
Passwords are stored as bcrypt hashes, never in plain text.

Payment security

Payments run through Razorpay: PCI-DSS Level 1, ISO 27001 certified and RBI-regulated.
Card details go straight to Razorpay's secure checkout. Auditaar never sees or stores your card number.
Every payment is encrypted over TLS.

Secured by Razorpay

Email authentication

SPF, DKIM and DMARC are published, with DMARC set to reject.
The DMARC policy asks receiving mail servers to reject messages that fail authentication for auditaar.com, which makes the domain harder to spoof.

Infrastructure

Hosted on ISO/IEC 27001-certified infrastructure.
Server access is SSH key-only, with root login and password login disabled.
A host firewall and automatic security patching are in place.

Accounts and access

Sign in with email and password (rate-limited against guessing) or with Google or LinkedIn.
Administrative access is limited to authorized Auditaar personnel by role.

Backups and recovery

Backups run automatically every night, encrypted before they leave the server.
They are stored off-site on Cloudflare R2 and kept on a rolling retention window.
Restores are tested, so the data can actually be recovered.

GDPR compliance

A published Privacy Policy covers what is collected, why, and for how long.
A Data Processing Agreement and EU Standard Contractual Clauses are available on request.
In the EU, the UK and Switzerland, analytics consent is denied by default via Google Consent Mode v2.

Assurance and compliance

Cloud Security Alliance Assurance

Auditaar's security and privacy controls are documented in the Cloud Security Alliance CAIQ and listed on the public STAR Registry.

CSA STAR Level 1

Your data

Data retention and deletion

Audit reports and dashboard access are removed after six months, so download the report within that window to keep it; a minimal score record is retained.
You can request deletion of your account and personal data at any time. Records that must be kept for legal, accounting or fraud-prevention reasons, such as invoices and payment records, are retained for the period the law requires and then removed.
Auditaar does not sell personal data, and shares it only with the service providers needed to run an audit.
Full detail is in the Privacy Policy, Terms of Service and Refund Policy.

Have a question or a vulnerability to report? Email info@auditaar.com. For a security report, include the affected URL and the steps to reproduce it.