Security & Complaints

1. Security controls

• Data is encrypted in transit (HTTPS). Our hosting and database providers encrypt stored data at rest; SubAudit does not add separate application-level encryption to invoice records.
• Where the optional bank-link feature is enabled, any stored access tokens are encrypted by the application before database storage.
• Workspace access is checked against team membership before any invoice or expense data is returned.
• Provider credentials (such as payment and email credentials) are configured on the server rather than embedded in the web app.
• Security logging for authentication and sensitive actions. Logs are designed not to contain invoice contents, tokens or file addresses.

2. Email one-time codes (MFA)

Signing in with a password requires an email one-time code. Authorising an optional bank-link consent also requires a code. Codes are time-limited, stored only as hashes in the session challenge, and never logged in full. Bulk export, email change and account deletion are not currently protected by an additional code.

3. Optional bank link

SubAudit does not initiate payments or move customer funds. Where bank-link data is used, it is minimised to the transaction history and account names needed to populate a workspace. Financial data is not sold.

4. Disconnect and deletion

When you disconnect an optional bank link, SubAudit disables the local connection and clears its stored access token. It attempts to revoke provider consent where the provider supports revocation. A separate account deletion flow removes account records.

5. Incident management

We assess, contain and investigate suspected security incidents and take remedial action proportionate to the risk. Where notification is required by applicable UK law, we will notify the relevant authority and affected individuals within the required timeframe.

6. Responsible disclosure

Please report a suspected vulnerability to support@subaudit.app. Do not access data that does not belong to you, disrupt the service, or publish details before we have had a reasonable opportunity to investigate. We aim to acknowledge good-faith reports promptly.

7. Complaints and governing law

To make a complaint, email support@subaudit.app or write to SUBAUDIT LTD, Dartford, Kent, United Kingdom (Director: Saikiran Chintha). Please provide enough detail for us to investigate. We will acknowledge the complaint, assess it fairly and provide a substantive response as soon as reasonably practicable.

If your complaint concerns personal data, you may also escalate to the Information Commissioner’s Office at ico.org.uk, referencing registration ZC233463. Security and complaint handling are governed by the laws of England and Wales.