We hold ourselves to the standard we help you meet.
AuditPilot stores compliance evidence for healthcare organizations, so the platform is built like the thing it audits: least privilege, verified uploads, signed access, and no quiet failure modes.
Tenant isolation on every request
Every workspace read and write is authorized against your membership and role — owner, admin, compliance officer, training admin, member, or auditor. There is no cross-tenant query path.
Private file storage
Evidence, BAAs, questionnaires, and certificates are stored in private blob storage with unguessable paths. Files are only ever served through authorized, role-checked download routes — never from public URLs.
Malware scanning on uploads
Uploaded files are enrolled in a malware-scanning queue and are blocked from download until they scan clean. Quarantined files never reach your team or your auditor.
Signed, expiring share links
Auditor portals and training links use cryptographically signed tokens with expiry and revocation. Tokens are stored hashed, compared in constant time, and scoped to exactly one workspace.
Encryption in transit and at rest
All traffic is TLS-only with HSTS. Data lives in managed Postgres (Neon) and Vercel Blob storage, both encrypted at rest.
Managed authentication
Sign-in is handled by Clerk with support for MFA. AuditPilot never sees or stores your password.
Monitored operations
Scheduled health checks watch the scanning and integration pipelines and alert our team when anything stalls — so silent failures don't become your problem.
Least-privilege integrations
Connectors like Microsoft 365 use read-only application permissions granted through your own admin consent, scoped to your tenant. Disconnect at any time from Settings.
HIPAA and your BAA
If you are a covered entity or business associate and AuditPilot will store PHI-adjacent evidence on your behalf, we will sign a Business Associate Agreement with you. Request one at hello@auditpilot.so — it's part of onboarding, not an enterprise upsell.
Subprocessors
We keep our vendor list short and hold each one to the same bar we set for your vendors:
| Provider | Purpose |
|---|---|
| Vercel | Application hosting and file storage |
| Neon | Managed Postgres database |
| Clerk | Authentication |
| Stripe | Billing and payments |
| Resend | Transactional email |
| Cloudmersive | Malware scanning of uploaded files |
| Anthropic (via Vercel AI Gateway) | AI assistance features |
Reporting a vulnerability
If you believe you've found a security issue, email security@auditpilot.so. We read every report, respond quickly, and won't pursue good-faith research.