Terms of Service

1. The service

We provide an online audit workspace (the "service") to your firm (the "firm"): planning, fieldwork, completion, the client portal and the storage of audit evidence, reached through a web browser.

The firm decides who in the firm may use the service, which engagements each person works on and what they may do. The firm admin who accepts these terms confirms they may bind the firm to them.

We aim to keep the service available at all times but do not promise uninterrupted availability. Planned maintenance is announced in advance where we can.

2. Data processing agreement

For the personal data held in the service (the firm’s people, its clients’ contacts, and any personal data in audit evidence) the firm is the data controller and we are its data processor, within the meaning of the Kenya Data Protection Act, 2019 and its regulations.

We process that personal data only on the firm’s documented instructions, which are these terms and the firm’s use of the service, and only to provide the service. We do not sell it and do not use it for any purpose of our own.

Everyone we allow to process the data is bound by confidentiality. Our platform staff see firm counts and usage, never client names or audit files.

We help the firm respond to requests from data subjects and to meet its own obligations (security, breach notification, data protection impact assessments) as far as the service allows.

We notify the firm without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with what we know and what we are doing about it.

3. Sub-processors and where data is held

We use these sub-processors: Supabase (database, file storage and sign-in; data held in the London region, United Kingdom), Vercel (application hosting) and our email provider (sending invitations, notifications and reminders).

Holding data outside Kenya is a cross-border transfer under Part VI of the Act. We rely on appropriate safeguards with each sub-processor and will give the firm the details it needs to document the transfer.

We tell the firm before adding or replacing a sub-processor, so it can object.

4. Retention

An archived engagement is kept for the firm’s retention period (set per firm, at least five years from the report date) and cannot be deleted before it ends, so the file stays available as ISA 230 requires.

Other data is kept while the firm uses the service and dealt with on termination as set out below.

5. Security

Each firm’s data is separated from every other firm’s in the database, and within a firm each engagement is visible only to its team. Data is encrypted in transit and at rest.

Two-step sign-in is available to every user, and firm admins can suspend a person’s access at once. Sign-offs are recorded against the person who gave them, and the activity log records changes to the audit file.

The firm is responsible for who it invites, for keeping sign-in details private, and for the content it uploads.

6. Termination and export

Either side may end these terms on notice. Before the service ends, a firm admin or engagement lead can download each engagement as a zip file (its registers, sign-offs, evidence and every working-paper version) from the app.

After termination we keep the firm’s data only for as long as its retention periods require, then delete it and its stored files, keeping only a record that the firm existed and when its data was deleted.

7. General

We may update these terms. A changed version is shown to the firm admin, who is asked to accept it before continuing; the version accepted, when and by whom is recorded.

These terms are governed by the laws of Kenya.