Security your information-security team can review.
Audit data is some of the most sensitive information a bank holds. AuditHD is built so that your own security team can inspect, test and run it, on their infrastructure if they choose.
Integrity of the record
Tamper-evident audit trail
Every change is written to an append-only log. Each entry includes the SHA-256 fingerprint of the one before it, and the database itself refuses edits and deletions. Anyone with access can verify the whole chain.
Evidence fingerprints
Each evidence file is fingerprinted on upload and checked on every download, so a replaced or altered file is detected.
Maker-checker by design
The person who raises a finding cannot issue it, and the owner of an action cannot validate its closure.
Access and isolation
Data separated in the database
Row-level security in PostgreSQL limits every query to one organisation, so an application fault cannot show one client's data to another.
Seven roles, least privilege
Auditees see only findings for their unit; viewers are read-only; administration is separate from audit work.
Sign-in protection
Passwords hashed with bcrypt and held to a strength rule, lockout after repeated failures, server-side sessions that can be revoked, and sign-out everywhere when a password changes.
Web protections
Strict content security policy, anti-CSRF checks on every change, rate limits on sign-in, and secure, HTTP-only cookies.
Secrets encrypted
API keys stored in the application are encrypted with AES-256-GCM using a key held only in the server configuration.
Security events for your SIEM
Sign-ins, failures, password changes and access denials are logged in structured form, ready to forward to your monitoring.
Hardened when you install it
The on-premises package follows container-hardening practice out of the box.
- The application runs as a non-root user with a read-only file system and no Linux capabilities.
- The database sits on an internal network with no route in or out, and the application connects with a role that has no superuser rights.
- HTTPS with TLS 1.2 and 1.3 only, and strict transport security.
- Nightly backups with checksums, and a restore command that verifies them first.
- Offline licence file signed with Ed25519: nothing calls home.
Data residency and regulation
AuditHD is designed so you can meet the rules that apply to you. Your compliance function decides how; here is how the product helps.
| Requirement | How AuditHD helps |
|---|---|
| SAMA cloud rules (Saudi Arabia) | Install on your own servers or in an approved in-Kingdom cloud. AI can be limited to on-premises models. |
| Saudi PDPL and similar privacy laws | Personal data is redacted before text reaches a cloud AI model; data stays in the deployment you choose. |
| State Bank of Pakistan and Central Bank of the UAE outsourcing rules | Deployment on infrastructure you choose, with backups and exit under your control. |
| EU AI Act transparency | AI-generated content is clearly marked, and every suggestion is logged with the person's decision. |
| Internal audit standards | Documented evidence, review and sign-off, and a complete trail of who did what and when. |
We are not a law firm, and this table is not legal advice. AuditHD has not yet been through an independent security certification; we are glad to support your own assessment or penetration test.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.