Privacy Policy

This Privacy Policy explains what information Exception Audit collects, why, how it is stored and protected, how long it is kept, and what control your organization has over it. It applies to the Exception Audit web application and any data submitted to it by your organization's authorized users.

This is a business-to-business (B2B) product. Exception Audit is used by an organization's own staff, acting on that organization's own documents — not by members of the public.

2.1 Account information

• Name and email address of each user you invite
• Organization name and settings
• Role (administrator or reviewer)

2.2 Documents you upload

• The files your organization submits for analysis (agendas, contracts, resolutions, budget spreadsheets, and similar administrative records)
• Facts extracted from those documents by our processing pipeline (amounts, dates, names, references), each linked back to its source document and page for verification purposes
• The review decisions your team makes on each finding (confirmed, dismissed, resolved, flagged for investigation) and who made them

2.3 Usage and system information

• Login timestamps and session activity
• An audit log of actions taken in your organization's account (uploads, review-state changes, report exports, user invitations) — this exists specifically so your organization has an accountability record of who did what and when
• Standard technical logs (error reports, performance data) that do not include document content

2.4 What we do NOT collect

• We do not collect information about members of the public who are not users of the application
• We do not require or collect government-issued ID numbers, payment card numbers, or financial account numbers
• We do not use your uploaded documents to train any third-party AI model. Documents are sent to our AI processing provider (see Section 5) solely to extract and compare facts for your analysis, under that provider's standard API terms, which — as of this policy's writing — exclude API-submitted content from model training. This is a contractual and technical protection, not a guarantee we can independently verify beyond publicly stated vendor terms, and we will update this section if that changes.

We collect only what is necessary to operate the service:

We do not sell, rent, or share your organization's data with third parties for marketing purposes. We do not use it for any purpose beyond providing the service to your organization.

We understand that as a government vendor, minimizing how long we hold your data is a priority. Exception Audit is built with that in mind:

• You set your own retention period. Each organization has a configurable retention setting (default: 365 days) after which analyses are automatically and permanently deleted, including the underlying files in storage — not just the database record.
• You can delete on demand. Any administrator can manually delete an analysis at any time. Deletion removes the uploaded files from storage and the extracted data associated with them.
• Account offboarding. If your organization ends its use of Exception Audit, you may request full deletion of your organization's account, all uploaded documents, and all associated data. We will confirm in writing once deletion is complete, within 30 days of your request.
• Audit log retention. Because the audit log itself serves an accountability function your organization may need for its own records, audit entries are retained for as long as your organization's account remains active, unless you request earlier deletion, at which point we will confirm what if any audit obligations your organization needs preserved separately before we proceed.

We do not keep your data longer than your organization has told us to.

• Application data and file storage: hosted on Supabase, which provides encryption in transit (TLS) and at rest (AES-256), and enforces strict access boundaries so that no organization can access another organization's data.
• AI processing: document classification and fact extraction is performed by our AI processing provider. Documents are transmitted securely for processing and are not retained by the provider beyond what is necessary to return the result, per the provider's API terms as of this policy's writing.
• Data location: United States (AWS US East region).

We do not use subprocessors beyond those named here without updating this policy and, where required by contract, notifying affected customers in advance.

Because our initial customers are Georgia local governments, this section addresses a few points specific to Georgia law:

• Georgia Security Breach Notification Act (O.C.G.A. § 10-1-912). If a breach compromises "personal information" as narrowly defined under Georgia law (such as a Social Security number, driver's license number, or financial account number combined with a name), we will notify your organization without unreasonable delay, and no later than 24 hours after we discover it, so your organization can meet its own notification obligations to any affected individuals. Exception Audit's ordinary use — board packets, contracts, budget records — is not expected to routinely contain this category of information, but this commitment applies regardless of what a given document happens to contain.
• Georgia Open Records Act (O.C.G.A. § 50-18-70 et seq.). Georgia courts have held that a private contractor holding records related to services performed for a government entity may itself be considered a "custodian" of those records for open-records purposes, meaning a records request could in some circumstances be directed at us rather than only at your organization. To keep this simple and keep your organization in control of its own records: your organization remains the custodian of record for all documents you upload, and we will refer any public-records request we receive directly to your organization's designated records officer rather than responding to it ourselves, unless we are legally compelled to do otherwise. We recommend this same allocation be stated explicitly in any pilot or service agreement we sign together.

• Role-based access control: every user's access is scoped to their organization and role; no user can access another organization's data under any circumstance.
• All file storage is private by default; documents are never publicly accessible and are served only via short-lived, signed access links.
• Every login, upload, review action, and data export is recorded in an audit log.
• All data is encrypted in transit and at rest.
• Access to production systems is limited to authorized personnel only.

On certifications: Exception Audit is built on strong baseline security engineering practices as described above. As of this policy's writing, we have not completed a formal third-party security audit or certification such as SOC 2. If your agency requires a specific certification as a condition of purchase, please raise this during the procurement conversation so we can address it directly rather than overstate our current status here.

Your organization's administrators can, at any time:

• View exactly what data is stored for your organization
• Export your organization's data
• Delete individual analyses or your entire account
• Review the audit log of all activity on your account

Exception Audit is a tool your organization uses internally, before a document package is finalized and published. We do not publish or make public any content submitted to the application. As described in Section 5A, your organization remains the custodian of record for uploaded documents, and any public-records request we receive will be referred to your organization's designated records officer. Your organization remains solely responsible for understanding how its own jurisdiction's public-records or open-meetings laws apply to documents and communications your staff create using this tool, including this application's outputs (exception reports, review notes) if they become part of your official record. We recommend confirming this with your own legal counsel or records officer.

Exception Audit is a business tool intended for use by adult professional staff of government and organizational customers. It is not directed at, and we do not knowingly collect information from, children.

We will notify your organization's administrator by email of any material change to this policy before it takes effect. Continued use of the service after that notice constitutes acceptance of the updated policy.

Questions about this policy, or requests regarding your organization's data, can be directed to:

support@exceptionaudit.com
Atlanta, Georgia