Traceable from the very first version.
ProAuditMap stores audit packages so that every change is preserved and can be checked later. The basis for this lies in the database, not only in the interface.
The building blocks.
-
Immutable versions
A package is never overwritten. Every change results in a new version with author, time and reason for the change. The database technically forbids changing or deleting versions, through permissions and triggers, not only in the application.
-
Audit log as a hash chain
Every entry contains the SHA-256 hash of the previous one and is written by a database trigger. A daily run checks the entire chain, so a later change in the database is noticed. In addition, the state of the chain is given an RFC 3161 timestamp every day outside the database and mirrored to a Storage Box that is only ever appended to. This makes it possible to show when a state existed.
-
Evidence files
Each item of evidence receives a SHA-256 checksum on upload, which is bound into the tamper-evident hash chain of the audit log. It is checked again on download and on archive export. Every file passes a malware scan before it is stored; a file that is not clearly recognised as harmless is rejected. Every hour, new evidence is copied in encrypted form to a separate location, so that it can be restored even if the server fails.
-
Approval with a frozen basis
A package can only be approved without consistency errors. Dates, effort and the name of the approving person are then frozen; later exports of the same approval show the same content. Archived audits are read only.
-
Retention and deletion
The default is 10 years from archiving, adjustable from 6 years, with an option of up to 30 years. After it expires, a deletion proposal is created. Deletion happens only after confirmation by your administration, and the deletion log is kept permanently.
-
Archive export
An archived audit can be exported as a ZIP in archive format v2: all documents, the version history, working papers with evidence files, populations and samples, an excerpt from the audit log and a manifest with a SHA-256 checksum for each file. An included verification script checks the contents without ProAuditMap, offline and without additional software other than Node.js.
-
Sign-in and tenant separation
Every sign-in requires a password and a one-time code from an authenticator app. Each tenant has its own database schema; another tenant cannot even be detected as existing from the outside. In the Business and Enterprise plans an IP allowlist restricts access to up to 50 approved networks; a list that would lock out your own address cannot be saved.
Hosting and data processing.
The application and database run in data centres in the EU. To generate drafts we use a service provider that also processes data outside the EU. Which service providers process data on our behalf and how transfers are safeguarded is stated in the privacy policy and the data processing agreement.
What ProAuditMap does not replace.
ProAuditMap is not a certified archiving system. The measures described support your evidence and retention obligations. Your procedural documentation and the assessment of whether the tool fits your requirements remain your responsibility.
Verification script for the quality evidence.
An external reviewer can verify a quality evidence package without ProAuditMap. Please download the verification script here rather than from the evidence package, and compare its SHA-256 with the value below.
Download the verification script
SHA-256 of the verification script: 00ac90020eafaf1f5a561c5ed57a2e2076c5741247e2cfabdbf18785d4fa10c3
Planning and plan export.
Plan versions, resolutions and board reports are entered in the hash chain with their checksum. Versions of audit objects, risk ratings and annual plans are immutable; a correction produces a new version, and the earlier one stays readable.
The plan export (head of audit only) contains a verification script with which you can recalculate plan versions and log rows without ProAuditMap. It needs Node.js 18 or later and no further packages. The script checks checksums, the plan proposal and chain rows within the export; that no chain row is missing is shown only by comparison with the running chain at the provider (daily chain check and timestamp). The export contains no free texts of the planning.
Compare the checksums of the file verify.mjs and of the files in the lib/ folder from the export with the values below.
SHA-256 of the files from the plan export:
verify.mjs:f4c16f8bc23ecffa0d599282a970364f7252fc0c9bda8cb27f311f8b68cb5fb9lib/capacity.js:7f483707e1a515bfd6dcfe2ac605265bb66b60ab0b9fb65c81d0725de5a21437lib/constants.js:393b7f984072d5b40c33a123424591fe4c95cb9b275fa7306ffcd56aa1c3ac5flib/fiscal-year.js:32524b6d33f2cfeedf90634b33d40733bf4ca4e7f65741ebd65d8e8c63ddefeclib/package.json:1239d4d885dcad42201a27ed9324f8f0f760b78700d8db9ced39a511cffe7eaelib/propose-types.js:8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881lib/propose.js:2e6b9948933520d0d8ce4dc5a477e9e908a60b08e0577314814a153aa0e58449