Welcome to eAuditor cloud® Trust Center!

No. Customer data is not used to train AI models belonging to BTC or any third parties. The exception is the eA Intelligence feature, which uses artificial intelligence services (ChatGPT) solely for the analysis, classification and interpretation of data at the express request of the user. In this case, the data is transferred only in the context of a specific query, is not permanently stored on the AI service side, and is not used to train models. Data processed within eA Intelligence is transferred outside the eAuditor cloud system to the OpenAI service. The use of eA Intelligence is an optional feature available in the basic version of the system.

Access to customer data is strictly limited to authorised personnel of BTC sp. z o.o. who need this data solely for the purpose of customer service, service maintenance or the fulfilment of legal obligations. Access is granted in accordance with the principle of minimum privileges and is subject to control.

Customers can independently update their personal data, such as contact details, billing information, or login-related data, directly in the eAuditor Cloud account settings. If additional corrections are required or if there are any questions regarding the processing of personal data, customers can contact BTC sp. z o.o. directly at [email protected].

The current list of subprocessors used within the eAuditor cloud is available in the Subprocessors section at: Subprocessors section.

Data protection in eAuditor Cloud is based on a combination of technical and organisational security measures and regular security audits. Data is transmitted in encrypted form, logically separated between customers and processed in a certified cloud infrastructure. The security of the system is additionally verified through independent vulnerability and penetration tests. Access to the system is protected by authentication mechanisms, including multi-factor login, and user sessions are automatically terminated in case of inactivity.

No. Each customer has their own separate database in the OVHcloud cloud environment. The eAuditor Cloud agent connects only to the assigned customer instance using an individual identifier, which prevents access to other customers' data.

Yes. All customer data is logically isolated within the cloud environment. Isolation includes application data, configurations, logs, and operational information, ensuring complete separation between customers using the service.

The eAgent service runs on the endpoint as a system service, i.e. with high technical privileges. However, eAgent itself does not make any changes that would affect the operation of the station or the user. It only performs actions resulting from the system configuration. Administrative changes on endpoints can be made by the system administrator on the client side using the remote management function. The scope of these actions depends on the permissions granted and the system configuration. eAuditor Cloud does not perform such operations automatically or without the administrator's decision. The tool provides possibilities, but it is the client who decides how and whether to use them.

Yes. Audit logs are available only to users with appropriate permissions granted in the system. The scope of visible data depends on the user's role, and logs can be exported for auditing, control, or internal analysis purposes.

Yes. A user session is automatically terminated after 20 minutes of inactivity. Five minutes before the session expires, the system displays a visible warning, allowing the user to maintain continuity of work.

Yes. eAuditor cloud uses built-in mechanisms to protect against brute-force and abuse attempts. This includes limits on failed login attempts, adaptive lockouts, and rate limiting on sensitive operations to prevent automated attacks and unauthorized access.

Yes. The platform enforces limits and timeouts on selected system operations, including reporting and data processing tasks. This protects the service from misuse, overload attempts, and denial-of-service scenarios.

Yes. The platform supports monitoring of execution times and abnormal processing behavior. This helps detect performance anomalies, misconfigurations, and potential misuse.

Yes. All built-in security controls are centrally managed by BTC and enforced by default in the cloud environment. Customers operate in a secure-by-default model, eliminating risks related to misconfiguration.

Yes. In addition to secure cloud infrastructure, eAuditor cloud includes an internal application security layer covering authentication protection, communication restrictions, file security, data operation controls, and platform hardening.

Yes. Detailed system error information is not exposed to end users. This limits the risk of sensitive technical data disclosure that could support exploitation attempts.

Yes. Outbound connections can be restricted to approved servers and services only. This includes controls for allowed SMTP servers, proxy connections, and remote data import sources, reducing the risk of unauthorized communication or data exfiltration.

Yes. The system enforces file security controls such as allowed file extensions, file size limits, and optional metadata removal from uploaded files. These mechanisms reduce the risk of malicious uploads.

Yes. eAuditor cloud applies safeguards to data import and export operations, including protected CSV processing, source restrictions, and export size limits. These controls help prevent injection attacks and mass data exfiltration.

Remote access services use dedicated ports and encrypted communication. Certificate-based security and trusted certificate authorities are used to protect remote connections and administrative operations.

eAuditor Cloud offers advanced DLP (Data Loss Prevention) mechanisms that help reduce the risk of data leakage and unauthorised use. The system allows you to monitor data operations, enforce security policies, and respond to potential breaches in accordance with the administrator's configuration. A detailed description of DLP features is available in the documentation.

If a customer suspects a security vulnerability or notices a potential security-related issue, they can report it directly to the support team by sending an email to [email protected]. BTC sp. z o.o. supports responsible vulnerability disclosure and follows a structured process for receiving, analyzing, and handling security reports. Each report is verified, and if an issue is confirmed, appropriate remediation actions are taken.