# Trust and security
> Audit is a trust business. Here is who is responsible, how we're supervised and what happens to your data. Our security controls are monitored continuously, and you can check them yourself.

Trust center: https://trust.repodo.com

## Who is responsible

Repodo Statsautoriseret Revisionsanpartsselskab, CVR 46715683, Kongens Nytorv 8, 3., 1050 Copenhagen K, Denmark.

Your audit opinion is signed by a named, state-authorised auditor at Repodo Statsautoriseret Revisionsanpartsselskab, who is personally responsible for it. Repodo's technology is built by Repodo Platform ApS, a sister company in the same group.

## Regulation and oversight

- Approved and registered by the Danish Business Authority (Erhvervsstyrelsen)
- Statutory audits performed under the Danish Auditors Act (revisorloven)
- Subject to the public quality inspection overseen by the Danish Audit Oversight Board (Revisortilsynet)
- Audits performed in accordance with the International Standards on Auditing (ISAs)
- Professional indemnity insurance, as the law requires
- Independence rules apply to every engagement

## Your data

- **Read-only access.** We never write back to your accounting system.
- **Only what the audit needs.** We collect and process only the data required for the audit.
- **Encrypted at rest and in transit.** Datastores holding customer data are encrypted, and data sent over public networks uses secure, encrypted protocols.
- **Restricted, authenticated access.** Access to production systems, databases and encryption keys is limited to authorised people with a business need. Remote access requires multi-factor authentication.
- **Monitored and logged.** We use log management and system monitoring to detect events that could affect security.
- **No model training.** Your data is not used to train or fine-tune AI models, by us or by our AI providers.
- **Retained and disposed of by policy.** Formal retention and disposal procedures govern customer data. Audit documentation is kept for the period the law requires.

## See our controls, live

Our trust center, powered by Vanta, shows the status of our security controls as they're monitored, across five areas:

- Infrastructure security
- Organisational security
- Product security
- Internal security procedures
- Data and privacy

We have engaged an independent auditor for SOC 2 Type 1 and Type 2 reports.

## AI prepares. People decide.

AI collects data, reconciles, tests and drafts documentation. Every exception it raises is reviewed by a state-authorised auditor, and every conclusion is a person's. No AI system signs, concludes or issues an audit opinion.

## People and process

Everyone at Repodo signs a confidentiality agreement and code of conduct, completes security awareness training when they join and every year after, and works on managed, protected devices. Changes to our systems are reviewed, tested and approved before they go live, and we have business continuity and disaster recovery plans in place.

## Privacy

We process personal data under the GDPR. Repodo Platform ApS is the controller for data collected through this website. A data processing agreement and our list of sub-processors are available on request. [Privacy Policy](https://repodo.com/privacy-policy)

## Report a security issue

Found a vulnerability? Write to security@repodo.com. We'll respond quickly and keep you updated.