SECURITY

We practice what we preach

AuditOak helps you pass audits, so we hold our own platform to the same bar: access control, encryption, audit trails, and human-confirmed trust.

Encryption

Data encrypted in transit (TLS 1.2+) and at rest. Evidence files stored in S3-compatible object storage with access controls.

JWT access tokens (15 min) with refresh token rotation. MFA support for all users. Separate token audiences for app and admin portals.

Six org roles with least-privilege enforcement at the API layer. Auditors get scoped, time-boxed read access, not full org visibility.

Append-only audit log for control status changes, evidence uploads, confirmations, and role changes.

We never auto-mark controls Verified, the same principle we sell is enforced in our own product architecture.

Production hosted on industry-standard cloud infrastructure with regular backups, monitoring, and dependency patching.

Answer a few questions and get a personalized, actionable checklist, free, no card.