1. Data We Process
Auditra Forensics processes transactional ledger data uploaded by verified and approved audit firms and forensic practitioners. We do not collect personal data beyond what is necessary for platform authentication and forensic analysis.
- Professional contact information (name, email, phone, firm affiliation)
- Transactional ledger data uploaded for forensic analysis
- Authentication credentials (hashed and salted)
- Platform usage metadata (upload timestamps, processing logs)
2. Purpose of Processing
All data processing is conducted for the sole purpose of providing forensic audit analysis services. Data is processed in the infrastructure region documented in your engagement's Data Handling statement.
3. Data Storage & Jurisdiction
Client ledger data is processed in Google Cloud Platform region us-central1 (United States). Client application records (submission, approval status, contact details) are stored in Google Cloud Platform region nam5 (multi-region United States).
Ledger data and scored artifacts are stored in shared cloud storage, logically partitioned per engagement. Physical isolation per engagement is not provided by default; the Data Handling statement accompanying your engagement documents the specific storage terms.
For South African clients, cross-border transfer of personal information to the United States is governed by POPIA Section 72. The transfer framework is documented in the engagement agreement and is one of: your express consent, standard contractual clauses imposing POPIA-equivalent protections, or an adequacy determination.
4. Data Retention
The inbound ledger is purged automatically (best-effort) after the scored ledger is written and its SHA-256 recorded. Scored artifacts and working papers are retained for the duration of the client's active engagement. Upon client request, all client data is permanently deleted within one business day. A deletion receipt listing the object paths removed is provided.
5. Cookies
Auditra Forensics uses only essential authentication cookies required for platform operation. No tracking, analytics, or advertising cookies are deployed.
6. Third-Party Access and Sub-Processors
We do not sell or share client data. Two sub-processors receive or process data:
- Google Cloud Platform — compute, storage, database, logging. Data residency: United States.
- Lark Suite — transactional email delivery (confirmation emails and administrative notifications). Receives email addresses and notification content only, not ledger data or scored artifacts.
Access to client data is limited to the pipeline's service account and to the named engineers supporting the engagement. Engineer access is read-only for diagnostic purposes and all access is logged.
7. Regulatory Compliance
Auditra Forensics is designed to support compliance with:
- POPIA (South Africa)
- GDPR (European Union)
- CCPA (California, United States)
- UK GDPR (United Kingdom)
Clients are responsible for configuring jurisdictional settings appropriate to their regulatory obligations.
8. Contact
For privacy-related inquiries or data subject requests, contact:
Data Protection Officer
Auditra Forensics, a SILKE Group company
support@auditraforensics.com