SOC 2 Type II attested
CoAuditor

Data Security & Privacy Policy

Version 1.1. Last updated: October 2026.

On this page
  1. 1.Introduction
  2. 2.Data We Collect
  3. 3.How We Use Your Data
  4. 4.Data Storage & Infrastructure
  5. 5.Data Security Measures
  6. 6.Data Retention & Deletion
  7. 7.Backup & Disaster Recovery
  8. 8.Third-Party Services
  9. 9.Incident Response
  10. 10.Compliance & Certifications
  11. 11.Your Rights
  12. 12.Policy Updates
  13. 13.Contact Information

1.Introduction

This Data Security & Privacy Policy describes how Pibicy ("we," "us," or "our") collects, uses, stores, and protects information when you use the Coauditor platform ("Service"). We are committed to protecting the confidentiality, integrity, and availability of your data.

This policy applies to all users of the Coauditor platform, including audit professionals, clients, and any other individuals who interact with our Service.

2.Data We Collect

2.1 Account Information

  • Name and email address
  • Organization name and details
  • Authentication credentials (securely hashed)
  • Role and permission settings

2.2 Audit Data

  • Project and engagement information
  • Document requests and responses
  • Uploaded documents (PDFs, spreadsheets, word documents, images, emails)
  • Annotations, comments, and observations
  • AI-generated analysis and findings

2.3 Usage Data

  • Access logs and timestamps
  • Feature usage patterns
  • Browser and device information
  • IP addresses

2.4 Payment Information

  • Billing details are processed and stored by our payment processor, Stripe
  • We do not store credit card numbers on our systems

3.How We Use Your Data

We use collected data to:

  • Provide and maintain the Coauditor platform
  • Process and analyze documents using AI capabilities
  • Enable collaboration between audit teams and clients
  • Send service-related communications
  • Improve our platform and develop new features
  • Ensure security and prevent fraud
  • Comply with legal obligations

We do not sell your data to third parties.

4.Data Storage & Infrastructure

4.1 Hosting Environment

  • Infrastructure hosted on Amazon Web Services (AWS)
  • Each customer workspace is hosted in one region: EU (Frankfurt, eu-central-1) or US (Ohio, us-east-2)

4.2 Multi-Tenant Architecture

  • Each organization's data is logically isolated at the database schema level
  • Strict tenant separation enforced at application, API, and database layers
  • No cross-tenant data access is possible through the application

4.3 Data Residency

We can accommodate regional data residency requirements. Please contact us to discuss your specific requirements.

5.Data Security Measures

5.1 Encryption

In transit

  • All data transmitted between users and our platform is encrypted using TLS 1.2 or higher
  • API communications use HTTPS exclusively
  • Internal traffic between our services stays inside our private AWS network (VPC)

At rest

  • Documents stored in AWS S3 use AES-256 server-side encryption
  • Database storage uses AWS RDS encryption with AES-256
  • Database encryption keys are AWS-managed keys in AWS Key Management Service (KMS). Document storage uses Amazon S3 managed keys.
  • Backup data is encrypted using the same standards

5.2 Authentication & Access Control

User authentication

  • Secure JWT (JSON Web Token) based authentication
  • Passwords are hashed with bcrypt, and password rules enforce minimum complexity
  • Support for Single Sign-On (SSO) via SAML 2.0 and OpenID Connect (OIDC)
  • Session management with automatic timeout: access tokens expire after 15 minutes

Application access control

  • Role-based access control (RBAC) throughout the platform
  • Granular permissions for projects, requests, and documents
  • Client portal with restricted access scope
  • Audit trail of sign-ins, project access, and changes to key records

5.3 Infrastructure Security

Network security

  • AWS Virtual Private Cloud (VPC) isolation
  • Security groups restricting network access
  • No direct database access from public internet

Monitoring and detection

  • Application-level audit logging of sign-ins, project access, and changes to key records
  • Automated vulnerability scanning via GitHub Dependabot and OSV-Scanner
  • Regular penetration testing
  • Continuous monitoring of infrastructure health with Amazon CloudWatch alarms

6.Data Retention & Deletion

6.1 Active Subscriptions

  • All customer data is retained for the duration of the active subscription
  • Data remains accessible and can be exported by authorized users

6.2 Subscription Cancellation

  • Upon subscription cancellation, data is retained for 6 months
  • This retention period allows for account reactivation if needed
  • After 6 months, all customer data is permanently deleted

6.3 Data Deletion Requests

  • Customers may request immediate deletion of their data at any time
  • Deletion requests are processed within 30 days
  • Deletion includes all documents, projects, user data, and associated metadata
  • Deletion from backup systems occurs within the normal backup rotation cycle (up to 35 days)

6.4 What We Retain

After account deletion, we may retain:

  • Anonymized, aggregated usage statistics
  • Records required for legal or regulatory compliance
  • Billing records as required by financial regulations

7.Backup & Disaster Recovery

7.1 Backup Procedures

  • Automated daily database backups
  • Point-in-time recovery (PITR) capability for database restoration
  • Document storage (S3) with built-in redundancy and versioning
  • Backups are encrypted using the same standards as primary data

7.2 Recovery Objectives

  • Recovery Point Objective (RPO): Up to 24 hours for standard recovery
  • Point-in-time recovery available for database to any point within the 35-day retention window
  • Regular testing of backup restoration procedures. The most recent restore test passed in May 2026.

8.Third-Party Services

We use third-party services (subprocessors) to host and run the platform, process payments, and provide AI features. The current list of subprocessors is in our Trust Center at trust.pibicy.com.

All third-party providers are selected based on their security practices and compliance certifications. We maintain data processing agreements with all providers who process customer data.

8.1 AI Processing

  • Documents and prompts for AI features are sent to Google Gemini, Anthropic Claude (through Amazon Bedrock or the Anthropic API), or OpenAI (through Amazon Bedrock or the OpenAI API)
  • Each AI task uses a fixed list of providers. If a provider is not available, the task goes to the next provider in the list.
  • AI providers process data according to their enterprise/API terms, which prohibit training on customer data
  • We do not use customer data to train AI models
  • AI processing results are stored within our secure infrastructure

9.Incident Response

9.1 Security Incident Procedures

In the event of a security incident:

  • Detection & Containment: Immediate action to identify and contain the incident
  • Assessment: Evaluation of scope, impact, and affected data
  • Notification: Affected customers notified within 72 hours of confirmed breach
  • Remediation: Implementation of fixes and preventive measures
  • Documentation: Full incident report and lessons learned

9.2 Reporting Security Issues

If you discover a security vulnerability, please report it to security@pibicy.com.

10.Compliance & Certifications

10.1 Current Status

We have completed an independent SOC 2 Type II attestation covering Security, Availability, and Confidentiality.

The SOC 2 Type II report is available to customers and prospects under NDA in our Trust Center at trust.pibicy.com, or via security@pibicy.com.

10.2 Compliance Commitments

  • GDPR compliance for EU data subjects
  • Regular security assessments and penetration testing
  • Continuous improvement of security controls

11.Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your data
  • Portability: Request your data in a portable format
  • Objection: Object to certain processing activities

To exercise these rights, contact us at privacy@pibicy.com.

12.Policy Updates

We may update this policy from time to time. We will notify users of material changes via:

  • Email notification to account administrators
  • In-application notification
  • Updated "Last Updated" date on this document

Continued use of the Service after changes constitutes acceptance of the updated policy.

13.Contact Information

For questions about this policy or our security practices:

Security inquiries: security@pibicy.com
Privacy inquiries: privacy@pibicy.com
General support: hello@pibicy.com

Pibicy Inc.
Ontario, Canada

This document is intended for informational purposes and to communicate our security practices to customers and prospects.