FAQ
Questions audit partners actually ask.
Written for the person who signs the opinion, not the person watching the demo. Where the honest answer is "not yet", it says that.
Responsibility and defensibility
Does using AI put my inspection defence at risk?
The opposite is the design goal. Every conclusion links to the standards clause behind it, every output is accepted or rejected by a named person, and the reasoning chain is stored rather than reconstructed under deadline. The resulting file is more traceable than a conventional one, not less — that is the entire premise of the product, and the reason it refuses to be a black box.
Who is responsible for the opinion?
You are, exactly as before. The software assembles the supporting file and never asserts the opinion. Where judgment is legally reserved to a professional, it surfaces what it found and stops.
What happens when the AI gets something wrong?
Nothing enters the file on the model's authority, so a wrong proposal is simply a rejected proposal — and the rejection is recorded. The file shows what was considered and declined, which is itself useful under inspection.
Can I see why something was flagged?
That is the one-button trace: finding → risk → assertion → procedure → clause. Each hop is a stored relationship, so it survives archive and staff turnover.
Does it replace judgment?
No, and it is built so it cannot. Screening is not permission — the independence gate, for example, surfaces what it found and requires a partner to attest. The tool never asserts permissibility itself.
Data, security and where things run
Is our client data used to train AI models?
No. Client data is not used to train models. The deterministic evidence layer — the part that reperforms controls and produces signed, replayable results — involves no model at all. Where a model is used for drafting, it runs under commercial terms that exclude training on submitted content. Firms that require client data never to leave their own environment can run the platform self-hosted, in which case the question does not arise.
Where does our data live?
Your choice. Self-hosted inside your infrastructure, or OSO-hosted with a dedicated database per firm. Tenant separation is enforced at the database layer, not only in application code.
Are you SOC 2 certified?
Not today. A Type 2 examination covering Security and Confidentiality is planned and the technical controls are in place. If procurement requires the report before a pilot, tell us at the start rather than at signature.
Can we run it on-premises?
Yes — self-hosted is built and has been for some time.
In our own cloud tenancy?
Designed, not yet shipped. We mark that distinction deliberately.
Will you answer our questionnaire?
Yes, and early. We would rather lose fast than discover a blocker at signature.
Standards, scope and practicalities
Which frameworks are covered?
11,683 clauses spanning ISA, IFRS, PCAOB Auditing Standards, the IESBA Code, SEC Regulation S-X, quality management standards, and MENA regulators including DFSA. Counted from the running system, not estimated.
What happens when a standard changes?
Amendments are tracked and queued rather than applied silently. An engagement pins to a methodology version, so a change mid-engagement cannot mutate a file that has already been concluded.
We already use audit software. Does this replace it?
Not necessarily, and we would rather establish that honestly than oversell. The distinct capability here is clause-level traceability and replayable evidence. If your current tooling already gives you that, we are not the priority. If it does not, that gap is exactly what this addresses.
Can we author our own methodology?
Yes. Firms author their own versioned workpaper and field universes, with a firm-admin authoring interface. Starter packs ship for financial audit, ICFR, SOC 2 and agreed-upon procedures.
Do you support non-English documents?
Yes — document intelligence is not English-only. Tell us the languages your practice actually audits in and we will show you that case specifically.
Not answered here?
Ask the awkward one.
The most useful message you could send is the specific reason you think this could not work in your practice.