Security & Trust

Core Primitives

• ✓Append-only audit log — events are immutable once written. No record can be modified or deleted, enforced at both application and infrastructure level with write-once object storage and immutability locks.
• ✓SHA-256 hash chain — every event is cryptographically chained to its predecessor. Any retroactive alteration breaks every subsequent hash, making tampering mathematically detectable.
• ✓RFC 3161 timestamping — each chain entry receives an independent timestamp from a trusted third-party Timestamping Authority (DigiCert), proving when an event was recorded. These timestamps are verifiable by any third party — including regulators and courts — without Audital's involvement.

Encryption Architecture

• ✓AES-256-GCM encryption with per-organisation key derivation using HKDF-SHA-256
• ✓Encryption keys are never stored alongside encrypted data
• ✓Audital infrastructure cannot access raw client records without the client's key
• ✓All data in transit encrypted via TLS 1.3 minimum
• ✓Integration credentials encrypted using AES-256-GCM before storage at rest
• ✓Per-organisation key derivation: org_key = HKDF-SHA-256(master_key, salt=org_id, info="audital-v1", len=32)

Hash Chain Architecture

• ✓SHA-256 hash chain: every event chained to the previous record
• ✓Chain formula: H(n) = SHA-256(H(n-1) ‖ event_id ‖ event_type ‖ payload_hash ‖ timestamp)
• ✓RFC 3161 timestamping via DigiCert Timestamping Authority — independent of Audital
• ✓RFC 3161 timestamps remain verifiable by any third party, including a regulator or court, without Audital's involvement
• ✓Tamper detection: any retroactive alteration breaks every subsequent hash, verifiably and mathematically
• ✓Append-only audit log enforced at application and infrastructure level
• ✓Write-once object storage with immutability locks

Residency is selected at onboarding and cannot be changed after provisioning without full data migration. Global Enterprise clients receive dedicated data residency confirmation in their Data Processing Agreement.

Authentication

• ✓Multi-factor authentication (MFA) available for all users and enforced for admin roles
• ✓JWT-based session tokens with short expiry (15-minute access tokens, rotating refresh tokens)
• ✓Tokens are signed and validated on every request; revocation takes effect immediately
• ✓All authentication events — login, logout, MFA challenge, failed attempt — are recorded in the audit log

Role-Based Access Control (RBAC)

• ✓Granular role-based access control scoped per organisation
• ✓Predefined roles: Owner, Admin, Member, Viewer — each with least-privilege permissions
• ✓Owners can create custom roles with fine-grained permission sets
• ✓All permission changes are logged immutably in the audit trail
• ✓API keys are scoped to specific roles and can be revoked instantly
• ✓Privileged access requires MFA re-authentication and is time-limited

Incident Response Policy

• —Defined incident severity levels (P1 Critical through P4 Low) with documented escalation paths
• —P1/P2 incidents: engineering on-call alerted within 15 minutes, customer notification within 1 hour
• —P3/P4 incidents: triaged within 4 hours, resolved within standard SLA windows
• —All incidents are logged with root-cause analysis and published internally within 5 business days
• —Data breach notification to affected clients within 72 hours, in compliance with UK GDPR Article 33
• —Post-incident review conducted for all P1/P2 events, with remediation actions tracked to completion
• —Incident response plan tested quarterly through tabletop exercises
• —Full incident response policy available in the procurement pack on request

Testing Programme

• —External penetration test by a Crest-accredited third-party firm scheduled Q2 2026
• —Scope: web application, API endpoints, authentication, session management, cryptographic implementation
• —Results summary available to clients and prospective clients under NDA
• —Annual penetration testing cadence post-Q2 2026
• —Internal vulnerability scanning: continuous (automated) via infrastructure security tooling