AuditXA ("we," "us," or "our") operates the website at auditxa.com and provides a browser-based network security auditing tool for firewall, VPN, router, Active Directory and Microsoft 365 configuration analysis. AuditXA is operated by Monogon Solutions LLC.
For the purposes of data protection law, including the EU General Data Protection Regulation (GDPR) and the UK GDPR, we act as the data controller of the personal data described in this policy. We collect a limited set of data to operate your account — your email address, login activity, and billing status — and we do not collect special categories of data (health, biometric, racial/ethnic, political, religious, or similar). Saving an audit report to your account is entirely optional and only happens if you actively choose it; configuration and export files themselves (firewall, VPN, router, Active Directory, or Microsoft 365) are never uploaded to or stored on our servers.
AuditXA is a newly launched service. We have not yet appointed a formal EU Article 27 representative; we will do so before we have an established base of EU/UK subscribers, consistent with our obligations as our service grows. In the meantime, email is the fastest and most reliable way to reach us on any privacy matter, including exercising your data protection rights, and we aim to respond to all such requests within the timeframes set out in Section 10 below.
Contact for privacy matters:
Email: admin@auditxa.com
| Data | Why we collect it | How long kept |
|---|---|---|
| Email address | To create and manage your account; to send one-time login codes (MFA); to notify you of subscription changes | Until you delete your account + 30 days |
| One-time login codes (OTP) | Stored as a one-way cryptographic hash (not the code itself) to verify your identity at login. Never stored in plain text. | Automatically deleted after use or after 1 hour, whichever is sooner |
| Subscription status and plan | To determine whether you have an active subscription and which features to enable | Until you delete your account + 7 years (tax/legal requirement) |
| Payment provider customer ID | To link your subscription to your account and process billing events | Duration of subscription + 7 years |
| Login timestamps and IP address | Security logging — to detect suspicious access patterns and protect your account | 90 days, then automatically deleted |
| Audit activity log | Records which audit tool you used and your audit score (not the config content) for your audit history feature | Until you clear your history or delete your account |
| Rate limit records | To prevent abuse of the login system (max 5 OTP requests per 15 minutes per IP) | 24 hours, then automatically deleted |
This is the most important part of this policy for our users.
Your firewall, VPN, router, Active Directory, and Microsoft 365 configuration/export files are processed entirely within your web browser. They are never uploaded to, transmitted to, or stored on our servers.
When you paste or upload a configuration file:
You can verify this yourself by opening your browser's developer tools (F12 → Network tab) and observing that no configuration content is transmitted when you run an audit.
The one exception — reports you choose to save: if you click "Save to Cloud" or "Email me a copy," we store the resulting report (your score, findings summary, and the generic remediation guidance shown on screen) so you can retrieve it later. This is opt-in per report — nothing is saved unless you explicitly select it. Reports never contain your raw configuration file content, only the analysis output. You can delete any saved report at any time from your Audit History.
If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under Article 6 of the GDPR:
Processing your email address and subscription data to provide the service you have subscribed to, send you login codes, and manage your account.
Security logging (IP address, login timestamps, rate limiting) to protect our service and your account from unauthorised access. Our legitimate interest is the security of the platform; this does not override your rights.
Retaining subscription and billing records for 7 years to comply with financial and tax regulations.
Where we send you optional communications (such as product updates or newsletters), we will ask for your explicit consent and you may withdraw it at any time.
We use the data we collect strictly to:
We do not: sell your data, share it for advertising purposes, use it for profiling or automated decision-making, or process it for any purpose beyond what is described in this policy.
We share your data with the following third-party service providers only to the extent necessary to operate the service:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare cloudflare.com |
Web hosting, edge functions, database (D1) and file storage (R2) — stores account, subscription, and report data | Email, subscription status, OTP hashes, login logs, saved report content, IP addresses in server logs | Globally distributed edge network; primary data storage in the USA |
| Resend resend.com |
Transactional email — sends your one-time login codes | Your email address and the one-time code | USA |
| Stripe stripe.com |
Payment processing and subscription management | Email address, subscription data. Payment details are processed exclusively by Stripe — we never see or store your card details. | USA |
All third-party providers are contractually required to handle your data securely and only for the purposes we specify. We do not share your data with any other parties except where required by law.
We may disclose your data if required to do so by law, court order, or government authority, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
We keep your data only for as long as necessary for the purposes described in this policy:
When data reaches its retention limit, it is permanently deleted from our database. Backups containing the data are also purged within 30 days of the live deletion.
We implement industry-standard technical and organisational measures to protect your personal data:
localStorage and persist across browser sessions until the token expires or you sign out, whichever comes first.No method of transmission or storage is 100% secure. If you become aware of any security vulnerability in our service, please report it responsibly to admin@auditxa.com.
We use no advertising cookies, no analytics cookies, and no third-party tracking of any kind.
localStorage (not a cookie, but similar) — we store your login session token in your browser's localStorage so you stay signed in across visits. It persists until it expires (8 hours) or you sign out, and is never sent to third parties. This is strictly necessary for the service to function.
Our hosting provider (Cloudflare) and font provider (Google Fonts) may set standard infrastructure cookies as part of CDN delivery. These are outside our control but do not track you for advertising purposes.
Depending on your location, you have the following rights regarding your personal data. To exercise any of these rights, email us at admin@auditxa.com. We will respond within 30 days (EEA/UK: within 1 calendar month as required by GDPR).
You can request a copy of all personal data we hold about you.
You can ask us to correct inaccurate or incomplete data we hold about you.
You can ask us to delete your personal data ("right to be forgotten"), subject to our legal retention obligations.
You can ask us to restrict processing of your data in certain circumstances (e.g. while a dispute is resolved).
You can request your data in a structured, machine-readable format (JSON or CSV).
You can object to processing based on legitimate interests. We will stop unless we have compelling grounds.
We do not make any automated decisions that significantly affect you. No profiling is performed.
You have the right to lodge a complaint with your national data protection authority (e.g. ICO in the UK, your local EU supervisory authority).
Email admin@auditxa.com with the subject line "Delete my account" from your registered email address. We will delete your account data within 30 days and confirm when done. Billing records required by law (7 years) will be retained but isolated from the main account database.
AuditXA is a professional tool intended exclusively for adults (18 years or older) working in IT, network security, or related fields. We do not knowingly collect personal data from anyone under the age of 18.
If you believe a person under 18 has provided us with personal data, please contact us at admin@auditxa.com and we will delete that data promptly.
Our service providers are primarily based in the United States. If you are located in the European Economic Area (EEA) or the United Kingdom, your personal data may be transferred to and processed in the USA.
We ensure such transfers comply with applicable data protection law through the following safeguards:
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights regarding your personal information.
We collect: Identifiers (email address, IP address). We do not collect: financial information (handled exclusively by Stripe), biometric data, geolocation, internet activity beyond login logs, or sensitive personal information.
To exercise your California rights, email admin@auditxa.com. We will respond within 45 days.
We do not sell or share your personal information for advertising purposes. No opt-out is necessary, but we honor this right regardless.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make material changes (changes that significantly affect your rights or how we process your data), we will:
We encourage you to review this policy periodically. Your continued use of AuditXA after the effective date of any changes constitutes acceptance of the updated policy.
Previous versions of this policy are available on request by emailing admin@auditxa.com.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: