Privacy
OpenAuditor is operated by ERP.AI. This page explains what the hosted site and API store, why the service needs it, and how to remove audit data. It covers account records separately from the business records you submit for verification.
Account information
| Information | Purpose | Retention |
|---|---|---|
| Email address and account creation time | Identify your account, send sign-in codes and send a notice before an API key expires | Until the account is deleted |
| API-key and session digests | Authenticate requests without storing readable credentials | Until revoked or expired and cleaned up; keys expire after 365 days and sessions after 30 days |
| Key names, access (full or read-only), creation and expiry times, last-used time, and when the expiry notice was sent | Help you identify and manage your active integrations, and send each expiry notice once | With the associated credential record |
| Daily request, item and question counts | Apply quotas and show account usage | Until account deletion, with routine cleanup of daily counters older than 35 days |
| Sign-in challenge and code digests | Validate the emailed code and limit attempts | A code works once and expires after ten minutes; expired challenge records are cleaned up |
| Short-lived request and sign-in rate events | Apply rolling request and abuse limits | Pruned against the applicable window, with routine cleanup of events older than a day |
| A directory entry: email address, account id, creation time, plan, time of last activity and that day's request, item and question counts | Let the service's operators find an account and see service-wide usage, for support, billing questions and abuse prevention | Until the account is deleted; refreshed at sign-in and within five minutes of use |
The service's operators at ERP.AI can see the account information above on read-only admin pages: an account's email address, plan and billing status, daily usage for the last 30 days, and its API keys' names, access and dates. They never see a key or session value, which the service does not store, or your password, which does not exist. Each admin page view is logged. Operators cannot change an account from these pages.
OpenAuditor uses email for sign-in codes and for one notice 14 days before each API key expires. When you choose a paid subscription, your account email is also supplied to Stripe for billing. There are no newsletters and no marketing email. The service stores no OpenAuditor password.
The browser uses a short-lived sign-in challenge cookie and an authenticated session cookie. They support requesting a code and staying signed in. The session lasts up to 30 days; signing out removes the current session. See account security for credential controls.
The light/dark appearance switch saves your explicit choice in your browser’s local storage under openauditor-theme. It is not linked to your account or sent with verification requests. Clearing site data removes that choice and restores the default light appearance.
Billing information
When paid checkout is available and you choose to use it, Stripe processes payment details on its hosted pages. OpenAuditor sends your account email and an internal account identifier to associate the subscription with your account. Your audit records and verification results are not sent to Stripe.
OpenAuditor stores Stripe customer, subscription and Price identifiers, subscription status, the paid-through date and checkout recovery information. These records support access and billing recovery and remain with the account until deletion. Short-lived event records prevent duplicate payment notifications from applying twice. OpenAuditor does not store your full card number or security code. Stripe handles billing records under its privacy policy; contact ERP.AI about account deletion and associated billing records.
Business records sent for verification
| Operation | What is stored | When it is removed |
|---|---|---|
POST /api/v1/verify | No retained single-verification request or result after the response, apart from the model-answer cache described below | The call does not create an audit record to retrieve later |
POST /api/v1/audits | The request while the audit is queued or running; its status, summary and per-item results | The input request is removed when processing completes or fails. Audit records and results expire seven days later, or when you delete the audit sooner. Backups taken while the audit existed keep it for at most seven more days. |
| Verification marks | Whether you marked a result correct or incorrect, an optional note, and the marking time | With the audit |
| Cached model answers | A hash key, the model answer and its creation time. The key is derived from the model, question and context; the cache holds no request text. | The answer cache is separate from audit retention and has no fixed time-to-live in the current service. |
A result can contain facts, evidence references and excerpts derived from your input. Removing the original batch request does not mean its retained results contain no business information. Treat downloaded results and review notes with the same care as the underlying records.
The answer cache makes repeated questions reproducible and avoids asking the model again for the same inputs. Deleting an audit removes its stored request, results and marks; it does not remove the separate hashed answer-cache entries.
What the service does with submitted data
Your data is not used to train models and is not sold. It is processed to answer your requests and operate the service described here. Nothing you submit is passed to a third-party AI service: the decision model runs on OpenAuditor's own verification servers, and that runtime has no outbound Internet access.
Verification marks record your review of an audit. The current service does not automatically retrain the model or adjust its published qualification thresholds from those marks.
Supply the evidence the selected use case needs, and avoid unrelated personal information in descriptions, context or notes. The API checks the supplied data; it does not require access to your email inbox, bank account or enterprise systems to evaluate a JSON request.
Logs and connection information
Request and response bodies are not written to application logs. Logs record operational metadata such as method, path, status, duration, request id and account id. Avoid placing confidential information in a URL or item identifier when it is not needed.
The gateway receives the connecting IP address and forwards it as request metadata. Sign-in abuse limits use an IP-derived digest keyed with the gateway secret. Infrastructure providers may separately retain connection metadata, including IP addresses, under their own policies.
Infrastructure providers
| Provider | Role |
|---|---|
| Cloudflare | Serves the site, handles accounts and API keys, sends sign-in email, and forwards API requests. Stores encrypted copies of the service’s backups in its R2 storage, with an Asia-Pacific location hint. Cloudflare may also add its website-analytics script to public page responses. |
| Stripe | Processes optional subscription checkout, invoices, payment methods and the billing portal when paid plans are available. |
| Hetzner Online | Hosts the verification service in the United States |
These providers support delivery of the hosted service. Provider connection and website-analytics processing is separate from the model's verification work.
Deleting data and retaining your own records
Use DELETE /api/v1/audits/{id} to delete an audit before its retention window ends. The request must be authenticated to the account that created it. A successful deletion returns HTTP 204; the audit can no longer be retrieved through the API.
The audit store and the model-answer cache are backed up every six hours on the service's host for disaster recovery, and each backup is copied, encrypted, to Cloudflare R2 storage. The key that decrypts those copies is not kept on the service's host or with Cloudflare. Every backup, on the host and in R2, is deleted within seven days of being taken, so a deleted or expired audit can remain in backups for at most seven more days. A restore is only for recovering from a failure. It returns the service to the time of that backup, so an audit deleted after the backup was taken can reappear until its original expiry; delete it again if that happens.
Revoke API keys from your account page. Revoking a key prevents its further use; it does not itself delete audits created by that account. Export any results your organization needs before deleting an audit or before its expires_at time.
To delete your account or ask about your data, contact ERP.AI. Include enough information to identify your account or request, and leave credentials and confidential records out of the initial message.