Security
Client data held the way a CA firm would hold it
Your firm keeps PANs, bank details, portal logins and financial statements for every client. This page sets out where Audytee keeps them and who can reach them.
Where your data lives
- Audytee runs on Amazon Web Services in the Mumbai region (ap-south-1). The database, uploaded files and backups stay in India.
- The database is PostgreSQL on Amazon RDS with encrypted storage, daily automated backups kept for seven days, and deletion protection.
- Files sit in a private S3 bucket with all public access blocked. They are never given public links: every download passes through Audytee, which checks that the person belongs to the firm and may see the record.
- Application secrets are held in AWS Secrets Manager, not in code or configuration files.
Encryption
- Every connection to Audytee and to this website uses TLS.
- The database and file storage are encrypted at rest.
- Passwords and logins your firm keeps for clients are encrypted again with AES-256-GCM, using a key kept apart from the database. Each time someone reveals one, it is written to the audit log.
Who can see what
- Each firm's records are separate. Every record carries its firm, and every query is limited to the firm of the person asking.
- Owners set roles with a level for each module, and can limit staff and articles to the clients assigned to them.
- Two-factor sign-in with an authenticator app, which the firm can require of owners and partners.
- Members see every device signed in to their account and can sign any of them out; managers can sign out a member whose device is lost.
- One password policy applies to every firm, checked at sign-up, on change and on reset.
A record of every change
- Every client, task, invoice and register entry keeps its own activity trail.
- The firm's audit log holds every change anyone made, with who, when and what it was before. Entries cannot be edited or removed.
- Client data exports and credential reveals are recorded too.
Your data stays yours
- Owners can export every record as CSV at any time, or one client's complete file as a ZIP when a client asks for their records. Vault passwords are never exported.
- We do not sell data and do not show advertising. This website sets no cookies and loads no third-party scripts.
- Ask to close the account and deletion completes within 30 days; backups that still hold the data expire within a further 35 days.
- Codelix staff open a firm's records only at the firm's request.
Found a security issue?
Write to info@audytee.com with the details and we will work with you on a fix. The privacy policy covers what we hold and why.