Security & operation
Audit data is confidential. This page explains where your data lives, who sees what, how it is backed up – and what your server needs if you run Audhive yourself.
Who sees what – and what is logged
Sign-in
Own accounts with password and a second factor – authenticator app or passkey. Or single sign-on with Microsoft Entra ID.
Roles per tenant
Roles define who may see or edit overview, controls, audit, external audits, documents, questionnaire, control set, change log, Executive Board or admin.
Traceable
Every action and every sign-in is in the audit log, changes to fields with their history.
Support only with your code
In the cloud we only get access when a global admin creates a one-time code – time-limited and revocable. Every action of the support session is logged.
Where your data lives
Cloud
Every customer gets an own instance with an own database. We back up database and files every night, encrypted: the last 14 days plus 8 weekly and 12 monthly states. You request a restore directly in Audhive.
Self-hosted
Everything stays on your server. Audhive only contacts the licence and update service – with the licence status, without audit data. You set up backups in Audhive, also as a scheduled job.
Data export
A global admin can export everything at any time: Excel file, CSV per table and all files. Without passwords, second-factor secrets and access keys.
AI only if you want it
Without a key, AI is off. With a key, the content concerned goes directly to Anthropic or OpenAI – not via us.
Updates, licence and scheduled jobs
Updates
In the cloud we install updates. Self-hosted, you get signed packages via the update service; Audhive backs up automatically before installing.
Licence
Self-hosted, the licence covers one installation. Check every 7 days; without a connection Audhive keeps working for 30 days, then read-only.
Scheduled jobs
Backups, reminders and the update check run silently. Only when there is a problem do global admins get an e-mail – at most once a day per problem.
What your server needs (self-hosted)
For the cloud subscription you only need a current browser. For a self-hosted installation, your server needs the following.
PHP
The application is built on PHP without a framework – a clean PHP installation is sufficient.
MariaDB / MySQL
Audit data, controls, evidence metadata and users are stored in a relational database.
Web server
Reachable via HTTPS – required for passkeys and Microsoft Entra ID.
File storage
Evidence, documents and logos are stored in the file system of the installation – no object storage required.
Sign-in
Microsoft Entra ID (single sign-on) or own accounts with a second factor.
Network
Outbound HTTPS to license.it-sb.ch (licence check every 7 days, up to 30 days offline) and updates.it-sb.ch. Optional: Microsoft Entra ID, e-mail and your AI provider.