Compliance data, handled like compliance data.
AuditSail handles compliance data for regulated firms, so every design decision starts with the same question: what would a regulator expect?
- Data storedAWS London (eu-west-2)
- Encryption at restAES-256 · keys in AWS KMS
- Audit logAppend-only · daily Merkle-tree summary
- SOC 2 Type IIOn our roadmap · not yet under audit
- ISO 27001On our roadmap · not yet under audit
- ICO registeredNo. ZC096588
- Companies HouseNo. 16979974
Your data is stored in the UK.
Stored in the UK
Customer data and audit history are stored on AWS in London (eu-west-2). Some processing uses sub-processors outside the UK under UK transfer safeguards, listed in our DPA.
Encrypted at rest
Data is encrypted at rest with AES-256, using keys managed in AWS KMS.
UK GDPR
Registered with the ICO (ZC096588). Our DPA sets out how we process your data and lists our sub-processors.
Nothing is overwritten. Nothing is deleted.
The audit trail isn't a feature. It's the foundation.
Append-only event log
Every action is appended to a tamper-evident, append-only log. Past entries can't be edited or removed.
Cryptographic anchoring
Each day's entries are sealed in a Merkle-tree summary, so a changed record no longer matches the summary.
Regulator-ready exports
Grant temporary read-only access or generate signed PDF/JSON exports.
We see the assets. We never see the spend.
When AuditSail connects to your ad accounts, we use read-only scopes only.
What we can see
Active ad creative (image, video, copy, links)
Ad metadata - campaign name, status, targeting category
Landing page destination URLs
What we don't access
Ad spend, budgets, bids
Performance metrics, ROAS, conversions
Audience targeting data or PII
Ability to create, modify, or pause ads
Registrations and roadmap.
Checked against the official UK registers.
Instead of taking a firm's details on trust, AuditSail looks them up on the registers the regulators maintain. Status is re-checked at signup, whenever a campaign goes live, and every week. If a firm loses its authorisation, its campaigns pause.
Companies House
Legal name and whether the company is active.
FCA Register
Authorisation status, permitted activities and appointed representatives.
SRA register
Whether a firm is SRA-authorised, and on what terms.
ICO register
Data protection fee registration and expiry.
Insolvency Service
Practitioner licence number recorded and linked for review.
Running due diligence?
Ask for our sub-processor list or any security question, and we'll reply within one business day.
Ask about our security