Built for compliance, with the controls built in from day one.
AuditLens is a workspace for ISO 27001 programs. The platform is built around the same controls our customers are evidencing — tenant isolation, managed encryption keys, role-based access, and a tamper-evident audit trail are part of the product, not extras.
Built in by default
Eight controls, always on
- Tenant-isolated data model
- Database row-level isolation
- KMS-managed encryption keys
- TLS 1.2+ / AES-256 everywhere
- TOTP MFA + Google / Microsoft SSO
- HMAC-chained audit log
- Daily encrypted backups
- EU data residency by default
The controls that ship with the platform
Every item below is part of the product itself. No add-on bundles, no enterprise tier gates — these are the defaults.
Tenant-isolated by design
Every customer organization is scoped to its own logical tenant. All data access goes through tenant-aware queries; cross-tenant reads are not possible at the application layer.
Data isolation in the database
Postgres row-level isolation is enforced for every tenant-scoped table. Application code reads only via a tenant-bound database client; service-level connections do not bypass this.
Encryption keys managed in a KMS
Application secrets and signing keys live in a managed Key Management Service. Keys are rotated on a schedule, never embedded in source, and access is audited.
Encryption everywhere
TLS 1.2+ for every external request. AES-256 server-side encryption for object storage and database-managed volumes. No plaintext data leaves the platform.
Tamper-evident audit trail
Every mutation produces an HMAC-chained activity record. The chain lets an auditor verify integrity end-to-end — who changed what, when, in what order.
Backups & retention
Encrypted database snapshots are taken daily and retained for 30 days. Object storage is versioned with lifecycle rules. Restores are tested.
Identity, MFA & RBAC
TOTP MFA is enforceable for every account. Roles are scoped per resource. Google and Microsoft SSO are available for org-wide identity.
AI handling
LLM calls are routed through AWS Bedrock in your region. Prompts and responses are logged for audit and never used to train provider models.
How we run our own information security
AuditLens operates an Information Security Management System aligned to ISO 27001:2022. We have not yet completed an external certification cycle — this statement describes the practices we run today.
- Scope
All AuditLens products, services, and supporting infrastructure operated by AuditLens.
- Leadership
A named security owner is accountable to leadership for the ISMS. Security reviews are a standing item in leadership meetings.
- Risk management
A documented risk register is maintained using an ISO 27005-aligned methodology. Risks are reviewed quarterly and on material change.
- Statement of Applicability
We maintain an internal SoA covering all 93 ISO 27001:2022 Annex A controls. Inclusions, exclusions, and justifications are versioned.
- Policies
A policy library covering A.5 organizational controls is in force and reviewed annually. Acceptable use is part of onboarding.
- People
Security awareness training is mandatory at onboarding and annually thereafter. Production access requires background checks and named owners.
- Suppliers
Sub-processors are inventoried with their DPA and primary region. Customers are notified at least 30 days before a change.
- Continuous improvement
Incidents and findings feed corrective and preventive actions tracked through to closure.
Who else touches the data
Every party that processes customer data on our behalf, with the legal basis and primary region.
We notify customers at least 30 days before adding or removing a sub-processor that touches their data.
What you can hold us to
Written into our standard DPA and reflected in our internal runbooks.
Incident notification within 24 hours
Initial notification to affected customers within 24 hours of a confirmed incident, with a full follow-up within 72 hours.
DPA reviewed before contract
Our standard Data Processing Agreement (GDPR Art. 28) is available on request and turned around within 5 business days.
EU data residency by default
Customer data is processed in the EU (Frankfurt) by default. A US region is available for North American customers on request.
Portability and erasure rights
Full data export is available at any time. Account deletion is processed within 30 days; the audit log is retained as legally required.
Where AuditLens helps you
The standards and regulations the platform is designed to map against.
ISO 27001:2022
All 93 Annex A controls are pre-seeded in the workspace.
ISO 27005
Risk methodology, 200 starter risks, treatment workflows.
GDPR
DPA, EU residency, ROPA-friendly evidence structure.
NIS2-aware
Reporting workflows designed for the 24-hour CSIRT trigger.
SOC 2
Evidence cadence and audit trail compatible with Type II prep.
HIPAA
BAA-tracking and ePHI-handling workflows on request.
PCI DSS
CDE scope, segmentation evidence, and QSA-friendly export.
Cyber Essentials
UK customers — scoring and control mapping supported.
Need a DDQ, security questionnaire, or DPA?
Tell us which framework you’re working from (CAIQ Lite, SIG Lite, custom) and we’ll return a completed pack within 2 business days. The DPA is sent in the same response.
- CAIQ Lite + full
- SIG Lite
- Custom questionnaires
- Standard DPA (GDPR Art. 28)
Request the pack
We’ll come back within 2 business days.
Statements above describe AuditLens as of May 30, 2026. Material changes to our security posture or sub-processor list are reflected here within 14 days and notified to active customers per the DPA.