Built for firms that carry
other companies' compliance.
Your clients trust you with their most sensitive evidence. Here is exactly how AuditVanguard protects it — no marketing gloss, just the controls as implemented.
Sessions that can't be stolen by scripts.
Sign-in tokens live in Secure, httpOnly, SameSite cookies — never in localStorage — so malicious browser scripts (XSS) cannot read or exfiltrate them.
Inactive sessions get a countdown warning, then are terminated server-side. Walking away from an open laptop doesn't leave client data exposed.
TOTP authenticator apps with single-use recovery codes, plus step-up verification for sensitive account changes.
Passwords are bcrypt-hashed with per-user salts. Reset links are single-use and expire in 60 minutes, with no account enumeration. Repeated failures lock the account.
Sensitive fields such as MFA secrets are encrypted at rest with AES-256-GCM under a dedicated encryption key, separate from the database credentials.
Authentication and sensitive endpoints are rate-limited, and repeated failed sign-ins lock the account before a password can be guessed.
Every response ships with strict security headers.
HSTS forces encrypted connections, X-Frame-Options blocks clickjacking, and content-type sniffing, referrer leakage and cross-origin window access are all locked down.
The API only accepts credentialed requests from our own domains — no wildcard CORS, no third-party origins.
Every client workspace is enforced at the API layer with per-request ownership checks, and evidence files live in per-tenant storage paths.
File downloads use short-lived, download-scoped tokens — the session credential never appears in links, logs or browser history.
A record that stands up to scrutiny.
Every material action is appended to a tamper-evident, hash-chained log that anyone can verify independently.
Every PDF snapshot is preserved as issued, so what an auditor saw can always be reproduced exactly.
External reviewers work in a dedicated portal with read-only, engagement-scoped visibility — never inside your workspace.
Subprocessors we rely on.
Vulnerability disclosure: /.well-known/security.txt
For the cookies we set and how to control them, see the Cookies and similar technologies section of our Privacy Policy.
Where we stand today.
We run AuditVanguard on the same controls we sell. A formal SOC 2 examination has not yet been completed.
AI answers are grounded in your client's own evidence. Customer data is never used to train models, and LLM calls are configured zero-retention.
Every audit-log export is SHA-256 hash-chained and HMAC-signed. Run a verification on our public tool.
Report security issues to security@auditvanguard.com or via /.well-known/security.txt. We acknowledge reports within 72 hours.
Third-Party Verification
AuditVanguard is currently pursuing SOC 2 Type I certification. A penetration test is scheduled as part of our security roadmap. Results will be published here when available.
Independent attestation: planned.
Our own security posture
The controls AuditVanguard itself runs on, stated plainly:
- Passwords hashed with bcrypt and per-user salts
- Short-lived JWTs in Secure, httpOnly cookies
- Tenant isolation checked on every request
- Per-tenant object-storage paths for evidence
- SHA-256 hash-chained audit log with a public verifier
- NDA-gated client evidence access
- 60-minute, single-use password-reset tokens
Questions about our security posture?
We'll walk you through any control on this page — or put it to work on your first engagement today.
Last reviewed: June 15, 2026