Security at CoAuditor

Audit teams trust us with sensitive evidence. This page lists how we protect it.

Last updated: October 2026

Our policies, subprocessors, SOC 2 Type II report, and security questionnaire are in the Trust Center.

How we protect your data

An overview of our controls. Our Trust Center has the details.

Hosting
CoAuditor runs on Amazon Web Services. Each customer workspace is hosted in one region, in the EU or the US, with automated backups and point-in-time recovery.
Encryption
Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256. AWS manages the encryption keys.
Access control
The data of each client organization is isolated. Role-based access and single sign-on (SAML 2.0 and OpenID Connect) control who sees what.
Monitoring and testing
Regular penetration testing, automated vulnerability scanning, and audit logging of user activity.
AI processing
AI features use enterprise AI providers. They do not train their models on your data, and neither do we. AI results stay in your CoAuditor workspace.
Your data
Your data belongs to you. Your team can export it, and you can ask us to delete it at any time.

An independent auditor examined our controls for security, availability, and confidentiality. Customers and prospects can get the report under NDA.

We follow GDPR best practices for people in the EU. You can ask to see, correct, export, or delete your personal data.

We took the CISA Secure by Design pledge: we build security into the software from the start.

Questions from your security team go straight to ours.

Policies, subprocessors, and the SOC 2 report: trust.pibicy.com (opens in a new tab)
Security questions: security@pibicy.com
Report a vulnerability: security@pibicy.com
Privacy and data requests: privacy@pibicy.com
Support for customers: Select the Support icon in the top bar of CoAuditor, or write to support@coauditor.com