Skip to main content
An auditor is a person from outside your organization, such as the firm that audits you for SOC 2 or ISO 27001, who reads the compliance evidence you choose until an end date. An auditor works in a read-only workspace of their own, signs in with a second step of their own, and changes nothing. Every page they open and every file they download is recorded in your audit log. Business plan Auditors are part of Compliance. They are the other kind of outside person besides guests: a guest works on tickets you share, an auditor only reads compliance evidence.

​
Invite an auditor

Org admins open Compliance and click Auditors. Fill in Invite an auditor:
  • Email is required.
  • Frameworks: tick one or more. The auditor reads nothing of a framework you leave out.
  • Periods: leave every box empty to give every audit period of those frameworks, or tick only the periods the audit covers.
  • Include live status (current controls and registers): without it, the auditor reads frozen periods and what was stored when they froze. With it, they also read today’s status, open periods and your policy and vendor registers.
  • Access ends on: leave it empty for 30 days from today, or pick a date up to 365 days away. Access ends at the end of that day (UTC).
  • Note (shown to the auditor): optional, up to 1,000 characters. It appears in the invitation email and in the auditor’s view.
Click Invite auditor and confirm it is you (see Confirm sensitive actions).
  • An address with no account gets one, and an email with a link to set a password.
  • An address that already has an account gets an email with the sign-in link. The access becomes active when the person signs in to your organization or switches to it.
  • Both emails say what the person may read and until when, that a second sign-in step comes first, and that an auditor reads and downloads but changes nothing.
The invitation is refused, with the reason on the page, for an address that is a member or a guest of your organization, someone who is already an auditor here, a platform administrator, an existing account whose address nobody has proved they own, and when your plan’s limit is reached.

​
Plan limits

Business allows five auditors with live access at a time, and Enterprise 25. The count is by person across the organization family, so one auditor who reads several of your organizations counts once. An admin can send 20 invitations an hour, an organization 50 a day, and one address can be invited three times a day.

​
Change, extend or remove access

Each auditor is a card on the Auditors page with their frameworks, periods, whether live status is included, when access ends, who granted it and when they last read anything.
  • Edit access changes the frameworks, periods, live status and note. Click Save changes and confirm it is you.
  • New end date and Extend move the end date, to any day from tomorrow to 365 days away, so you can also end access sooner. You confirm it is you.
  • Remove ends access at once and asks for no confirmation code, so you can act quickly. The auditor loses access to your organization straight away, is emailed, and their MCP tokens stop working.
When a change gives the auditor less to read, their open pages reload with the new access. Show ended access lists the auditors whose access ended and how. Support staff acting as one of your admins cannot invite, change or remove an auditor.

​
End dates and warnings

Access stops the moment the end date passes. Each night SRE Agent records the ended access, emails the auditor, and emails your org admins once about every auditor whose access ends within seven days. A card shows ends in a number of days during that last week. Move the date and you are warned again about the new one. If your plan stops including Compliance, auditors read nothing until it does again; their access is kept.

​
What the auditor sees

The auditor signs in and lands on their own workspace. The top bar names your organization and the day their access ends. They see:
  • the frameworks and periods you granted, each period with its state;
  • for each control, its status and what it rests on, the notes your team marked for the auditor, the evidence files, the policies and vendors behind it, and how its status changed;
  • the finished exports of the periods they can read (a provisional export or a live report only with live status), to download;
  • with live status, today’s status of each control and your policy and vendor registers.
A frozen period shows what was stored when it froze, so a note or a file deleted later still reads as the period recorded it. Internal notes are never shown, and anything outside the access you gave reads as if it did not exist. An auditor cannot change anything, ask for an export, or open any other page of your organization, Slack or the API. They take no seat, and can download up to 30 exports and 30 evidence files an hour.

​
Their second step and idle sign-out

An auditor must use an authenticator app or a passkey of their own, with no grace period, whatever your organization requires. A sign-in through your identity provider does not count for them. Until they set one up, the only page they can open is their account page, where they set it up. An auditor’s session signs out after 12 hours without use, or sooner if your organization’s idle limit is shorter. See Two-step sign-in.

​
MCP access for an auditor

An auditor can read the same evidence from an MCP client with a token of their own. On their account page, under MCP access, they give it a name and an end date (at most 30 days, and never after their access ends) and confirm it is them. The token starts with sre_cat_, is shown once, and works only on the MCP endpoint, with nine read tools. They can hold two live tokens at a time and make five a day. Ending their access, shortening it or resetting their password ends or shortens the tokens too. See MCP tools.

​
See what auditors read

  • Each auditor’s card shows their last activity.
  • Audit Logs has an Auditor activity filter that lists every page an auditor opened (once per page every 15 minutes), every file and export they downloaded, every MCP call they made and every change to their access.
  • From now on, each period’s evidence bundle names who could read it and what they read during it, in two files under access/. Periods frozen before this feature have no such files; the audit log still has the reads.