How we handle your bill data.

• Encryption at rest

  Every uploaded bill is encrypted in the browser with AES-256-GCM before it leaves the device. We store the ciphertext + a per-record envelope key (KMS-wrapped). The plaintext bill is never written to our servers.

• Encryption in transit

  TLS 1.2+ enforced on every connection. HSTS preload, server-side certificate pinning on internal subprocessor calls.

• Access control

  Production database access is logged + role-based with least-privilege defaults. Engineers do not have standing access to user data; break-glass operations are audited.

• Audit logging

  Every access to a user’s audit is logged with actor, action, timestamp, and IP. Logs are immutable and retained 6 years (HIPAA-aligned). Users can request an excerpt of their own log via /settings/activity.

• Backups + verification

  Daily encrypted database backups retained 30 days, with a separate canary-row verification cron (api/cron/backup-canary) that confirms the backup actually restores. Failures open an incident on /status.

• Incident response

  Breach-notification target of 48 hours to affected users + any signed-BAA partners. The /status page is updated in real time during any user-facing degradation.

• Two-factor auth

  TOTP 2FA available on every account from /settings/security. Backup codes are issued at enrollment so account recovery never requires email support.

• New-device alerts

  A successful sign-in from a device we haven’t seen before fires a single notification email so users can react fast if it wasn’t them.

The vendors that touch user data on Audra's behalf. We maintain current BAAs with every subprocessor flagged as “Handles PHI” where HIPAA requires one. This list is reviewed quarterly; material changes are announced via the blog feed.

• HIPAA BAA available

  Active

  Counter-signed BAA template at /legal/baa. Partner orgs can countersign via /settings/security or by emailing support.

• SOC 2 Type II

  In progress

  Audit period started Q2 2026 with a Big-4-tier audit firm. Report target: Q4 2026.

• GDPR + CCPA data export / deletion

  Active

  Self-serve export + deletion at /settings/data. Deletion includes a 30-day grace window before permanent purge.

• PCI DSS

  N/A

  We never see card data. Stripe handles all PCI scope; we never store, process, or transmit primary account numbers.

• Train AI models on private user bills. Audit-pipeline LLM calls do not contribute back to model training. We use synthetic data + the public, opt-in research dataset for model improvements.
• Sell, share, or aggregate user data with marketing partners.
• Practice medicine or law. Audra surfaces billing-rule violations; we don't opine on clinical decisions.