DRAFT — planned audit controls; service not yet available
Security and data handling
This draft describes the controls required before audit services launch. It is not a claim that scanner, storage, payment or access integrations are already operating.
Read-only, least-privilege access
Public scans need no store or repository access. Access-based audits will request only view/read permissions for the selected store or repository. Never grant write or administrator access. You or your provider apply recommended changes.
Encryption, isolation and retention
Required launch controls include encryption for sensitive credentials and code, private report storage, and per-customer authorization/isolation. Storefront passwords must be deleted after the scan. Code copies must be deleted within 30 days after delivery, or sooner on request. Other retention schedules still require approval.
Deletion and removing access
The planned delivery flow will explain how to revoke access and request deletion, log the request and send confirmation. Any lawful retention exception must be explained. The automated workflow is not available yet.
Confidentiality and NDA
A mutual NDA may be requested before sensitive access is shared. The template is pending approval; no signed NDA or certification is implied by this page.
Payments and test orders
Audit payments are planned through Stripe-hosted Checkout so card data stays off AmeriBot servers. No live audit checkout is available. Test orders require separate explicit written permission, low values and the merchant's normal cancellation/refund process. Platform names do not imply endorsement or partnership.