Security and data handling
We are asking security teams to connect us to their identity providers. That obliges us to be more specific than most vendors are, and to be explicit about what we do not yet have.
Last reviewed 2026-09-07 · Report a vulnerability: security@humanaudit.ai
The four commitments
Read-only, always
No write scope is requested from any source. We cannot revoke, rotate, modify or delete anything in your environment. This is architectural, not a phase.
No secret values
We read that a credential exists, its scopes and its metadata. We never read, request or store the value of a secret, token or key.
No agent, no network access
Nothing is installed. No VPN, no firewall change, no inbound connection to your infrastructure.
One-click disconnect
Revoke from your own admin console at any time without contacting us. Access ends immediately.
What we store, and for how long
| Data | Stored? | Retention | Notes |
|---|---|---|---|
| Identity metadata | Yes | 90 days | Application names, identifiers, granted scopes, creation and last-use timestamps, and the resolved owner. This is the record. |
| Directory user records | Partial | 90 days | Only the fields needed to resolve ownership: display name, work email, account status. No personal data beyond that. |
| Secret and token values | Never | n/a | Not requested, not read, not stored, at any point. |
| Message, file or repository content | Never | n/a | We read application and identity metadata only. No mailbox, document, message or source-code content. |
| OAuth refresh tokens for our own connection | Yes | Until you disconnect | Encrypted at rest. Deleted on disconnection or on request. |
| Our own audit log of what we accessed | Yes | 12 months | Available to you on request, so you can verify what we actually read. |
Immediate deletion on request, confirmed in writing, at any point and for any reason. Email security@humanaudit.ai.
Architecture
How it is built
- Tenant isolation. Each customer’s data is held in a separate logical schema, with no shared query path between tenants.
- Encryption. TLS 1.2 or above in transit. Encryption at rest for all stored data, with OAuth credentials additionally encrypted at the application layer.
- Access control. Role-based access internally, with named individual accounts and multi-factor authentication required. No shared administrative credentials.
- Least privilege by construction. The connector requests the narrowest scope that returns the required data. Where a source offers a read-only variant of a scope, we use it.
- Regional hosting. Currently United States. EU residency is on the roadmap and not yet available — if that is a requirement, tell us before you connect.
How we run
- Dependency and vulnerability management. Automated dependency scanning with a documented remediation window: critical within 7 days, high within 30.
- Change management. All production changes via reviewed pull request. No direct production access for routine work.
- Logging. Every access to customer data is logged immutably, including by us, and that log is available to the customer.
- Sub-processors. A current list is available on request and before you connect. We will notify you before adding one that processes customer data.
- Incident response. We will notify affected customers within 72 hours of confirming an incident affecting their data, with what we know at the time rather than waiting for a complete picture.
Certifications: what we hold and what we do not
We hold none today, and we will not imply otherwise
HumanAudit does not currently hold SOC 2, ISO/IEC 27001, or any other security certification. Any vendor at our stage claiming these is either misrepresenting or has spent money on the wrong thing.
SOC 2 Type I is planned before general availability, followed by Type II. We will publish the report date here when we have it, and not before. If your procurement process requires a current certification, we are not yet a viable vendor for you — and we would rather say that now than waste your review cycle.
| Item | Status | Notes |
|---|---|---|
| Read-only architecture | In place | Verifiable from the scopes we request. |
| Tenant isolation, encryption at rest and in transit | In place | |
| Customer-visible audit log | In place | Provided on request. |
| Data Processing Agreement | Available | Signed before any connection where personal data is in scope. |
| Penetration test | Planned | Before general availability. The report will be available under NDA. |
| SOC 2 Type I | Planned | Not yet held. |
| SOC 2 Type II, ISO/IEC 27001 | Planned, later | Not yet held. |
| EU data residency | Roadmap | Not yet available. |
| SSO and SCIM for our own product | Roadmap | Not yet available. |
Reporting a vulnerability
Email security@humanaudit.ai. We will acknowledge within two business days and keep you updated until resolution.
We will not pursue legal action against anyone who reports a vulnerability in good faith, gives us reasonable time to remediate before disclosure, and does not access, modify or exfiltrate data belonging to others. We do not currently run a paid bounty programme; we will credit you publicly if you would like us to.
Reviewed it and want to proceed?
If your security team needs anything not covered here, ask us directly and we will answer in writing.