Trust Center

This reflects an internal, code-level security review of the application (not a third-party penetration test). It found no SQL injection, no XSS via the template layer, no committed secrets, and no unsafe deserialization anywhere in the codebase. The controls below are the ones that matter most to a security reviewer.

AuditFlow collects the account information needed to run the platform (username, email, full name, role, organization/site) and the audit data your team creates (documents, findings, action items, framework vault content) plus usage/audit-trail logs (logins, actions taken, features used). This data is used to run the platform, authenticate users, generate reports, and maintain the audit trail that gives your findings evidentiary value. It is not sold, and it is not used for purposes unrelated to operating AuditFlow.

This summary is not a substitute for the full policy. Read the complete Privacy Policy for the section-by-section detail, including data retention and third-party AI processing terms.

AuditFlow has not completed a SOC 2 audit, ISO/IEC 27001 certification, or an external penetration test. Any claim to the contrary is false — this section exists specifically to say so plainly. What has been done is an internal, code-level self-assessment against several major frameworks, used to prioritize the security roadmap above.

AuditFlow's AI features (finding generation, root-cause and corrective-action suggestions, evidence-review assistance, report drafting/polishing) support your team's work — they do not replace the maker-checker approval workflow. Every AI-assisted finding or report still goes through the same Draft → In Review → Approved review chain as manually written content before it's published.

AuditFlow is a server-rendered Flask application backed by SQLite, deployed today as a self-hosted, single-instance application per organization — not a shared multi-tenant cloud service. That's a deliberate, currently-accurate description, not a limitation we're hiding: your data lives in your own deployment, on infrastructure you control.

Encryption coverage today is a mix of what the application enforces directly and what depends on how a given deployment is configured. Both are stated below rather than blended into one claim.

There is no formal bug bounty program or dedicated security-disclosure inbox yet — that's planned. Today, if you believe you've found a security issue in AuditFlow, please report it through the Contact page with as much detail as you can provide (steps to reproduce, affected URL/route, and impact). We ask that you avoid accessing, modifying, or deleting data beyond what's needed to demonstrate the issue, and that you give us a reasonable opportunity to investigate and address a report before any public disclosure.

AuditFlow is deployed today as self-hosted, single-tenant software: each organization runs its own instance on its own infrastructure. Because of that, there is no shared, multi-tenant AuditFlow cloud status page today — uptime and incident response for a given deployment are owned by the organization operating it, the same way they'd own uptime for any other self-hosted application.

Protecting the audit data your team relies on combines access control, review workflow, and logging. Here's what's already enforced, and what's still on the roadmap.

This matches the retention terms in our full Privacy Policy.