Security & Trust
Skadi is audit intelligence for a network of Independent CPA firms. We protect customer data with the same care those firms apply to audit evidence.
This page describes our platform security practices in plain language. It is not itself a certification or independent attestation. For security reports, subprocessor lists, and assurance materials, contact security@skadi.ai.
Encryption
Customer data and audit evidence are encrypted in transit and at rest using industry-standard algorithms and key management.
Identity & access
SSO, role-based access control, and multi-factor authentication for Skadi staff. Access is granted on a need-to-know basis and reviewed regularly.
Segregated environments
Production, staging, and audit workpaper environments are separated by access rules and credentials.
Monitoring
Audit logging, anomaly detection, and vulnerability scanning help us spot and respond to issues.
Personnel controls
Team members complete security and confidentiality training and are bound by the AICPA Code of Professional Conduct on applicable engagements.
Vendor management
We review subprocessors for security and contractual commitments before connecting them to Skadi services.
Incident response
We maintain an incident response process with defined severities, on-call coverage, and customer notification commitments in our agreements.
Business continuity
Multi-region infrastructure and regular backups support availability and recovery objectives.
CPA firm standards
Independent CPA firms using Skadi operate under professional obligations that go beyond typical SaaS security:
- AICPA Code of Professional Conduct — integrity, objectivity, and due professional care apply to engagement teams.
- Independence — firms decline work that impairs independence and monitor relationships and financial interests as required by AICPA and SEC/PCAOB rules where applicable.
- Peer review — participating firms are enrolled in an AICPA-accepted peer review program. Reports are available on request.
- Quality management — firms maintain systems for engagement acceptance, resources, communication, and monitoring.
- Workpaper retention — audit documentation is retained by the firm according to AICPA standards in access-controlled storage.
- Confidentiality — client information is not disclosed without consent or legal obligation.