Audit Aware Security Overview

Last updated September 16, 2026

Purpose of This Overview

This Security Overview describes the administrative, technical, and physical practices Reason Consulting Corporation ("Reason," "we," "us") currently follows to protect Customer Data processed through Audit Aware, our web-based audit case management and geospatial business discovery service available at https://www.auditaware.com. It is written for procurement, information security, and records officers at state and local government tax, assessment, and revenue offices who need to understand how the service is operated.

This document is a description of current practice and is not a warranty, a service level commitment, or a certification. Our practices evolve as threats, technology, and the service change, and we may update this Overview at any time. Our contractual security commitments to a customer are those stated in the customer's Ordering Document and in the Audit Aware Data Processing Addendum, and this Overview is the document referred to in Section 22 of the Audit Aware Terms and Conditions. Where this Overview and an Ordering Document or Data Processing Addendum differ, the Ordering Document and Data Processing Addendum control.

Hosting and Infrastructure

Audit Aware is delivered as a multi-tenant software-as-a-service application hosted on Google Cloud Platform, Microsoft Azure, and Amazon Web Services infrastructure in data centers located in the United States, and the hosting providers do not have logical access to Customer Data as part of its ordinary operation of the platform.

Customer Data, including backups, is stored and processed only in United States regions and is not transferred outside the United States as part of our ordinary operation of the service.

Each hosting provider is responsible for the physical security of its facilities, including controlled access, environmental protections, and redundant power and connectivity, and publishes its own independent assurance reports covering those controls.

Our production environment is logically separated from development and testing environments. Because Audit Aware is a data product, we load a customer's Customer Data into a quality-assurance environment, protected by the same controls and accessible only to the same personnel as production, to validate that customer's data loads and product behavior; that environment remains available to the customer as a sandbox unless the customer asks us to remove its Customer Data from it, in which case we do so within thirty days.

Data Protection

Customer Data is encrypted in transit between users and the service using TLS 1.2 or higher, and connections using older protocols are refused.

Customer Data is encrypted at rest using AES-256 encryption managed by the hosting platform, including database storage, file storage for uploaded case documents, and backups.

Each customer's Customer Data is logically separated from that of every other customer by tenant identifiers enforced at the application and data layers, so that Authorized Users of one government entity cannot view or query the data of another.

We do not sell Customer Data, we do not use it for advertising or marketing, and we do not use it to train or improve any third-party or general-purpose model, and we tune the service with it only for the customer whose data it is, as stated in Section 8 of the Terms and Conditions.

Reason is affiliated with a firm that provides audit, discovery, valuation, and related professional services to government entities, as disclosed in Section 25 of the Terms and Conditions. Reason and each affiliate are separate corporate entities, and neither has access to the other's data or systems. Under the Data Firewall described in Section 8 of the Terms and Conditions, Customer Data and information derived from it are not used in, disclosed for, or made available to any such engagement, bid, or proposal, except as required by law or as the government entity that controls the data directs or consents in writing. The controls that enforce this restriction are described in Section 4.4 of the Data Processing Addendum.

AI-Assisted Features

Certain features of Audit Aware use artificial intelligence and machine learning models, including models provided by third parties, to assist a customer's users with tasks such as matching and classifying records, flagging anomalies, summarizing information, and drafting text, and every such output is decision support that the customer's users review; it is not a determination made by the service.

The prompts and instructions that Authorized Users submit to AI-Assisted Features, and the outputs those features return, are Customer Data and are protected by every practice described in this Overview and by Section 8 of the Terms and Conditions and the Data Processing Addendum.

Third-party model providers are engaged only under zero-data-retention terms: they receive Customer Data only in the requests we make to them, may not use it to train or improve their models, do not retain it after the request is processed, and process it in United States regions. We configure each provider's service to disable any data-sharing or training option, and each provider is identified on our subprocessor list.

We do not use Customer Data, including prompts and outputs of AI-Assisted Features, to train or improve any third-party or general-purpose model. We use a customer's Customer Data to configure and tune the prompts and settings the service uses for that customer's own account only, and never for another customer.

Access Control

Access within Audit Aware is role-based, and a customer's designated administrators assign roles to their Authorized Users, which determines the records, cases, and functions each user can see and act on.

Every user has a named individual account, and shared or generic accounts are not supported, so that activity in the service can be attributed to a specific person.

Case Manager licenses are assigned to named users under the customer's Ordering Document, and a customer's administrators can add, reassign, and deactivate users as staff and contractor assignments change.

Audit Aware supports single sign-on through a customer's own identity provider, such as Microsoft Entra ID, and we recommend that customers sign their users in through their identity provider and enforce multi-factor authentication there.

Reason personnel cannot view Customer Data through the service unless a customer's administrator invites Reason support into the customer's account, which the customer controls and can revoke. Apart from that, access to production systems and Customer Data is limited to a small number of United States-based production engineers with privileged database access, is granted on a least-privilege basis, requires hardware-security-key multi-factor authentication, and is reviewed and removed when a person's role changes or ends.

The service logs authentication events and administrative changes, privileged database access is logged, and these logs are retained to support security review and incident investigation.

Application Security

Audit Aware is developed under secure development practices that include code review before changes are deployed to production, separation of duties between development and deployment where practical, and change tracking for every production release.

Third-party libraries and components are inventoried and monitored for published vulnerabilities, and affected components are updated on a schedule that reflects the severity of the issue.

We run automated vulnerability scanning against the application and its infrastructure on every deployment to production, and we review the aggregated security findings reported by our cloud providers quarterly, and findings are triaged and remediated according to severity.

Monitoring, Logging, and Incident Response

Production systems are monitored for availability, performance, and security events, and alerts are routed to on-call personnel for investigation.

We maintain a documented incident response process that covers detection, containment, investigation, remediation, and notification, and we review and update it after any incident and periodically otherwise.

If we confirm a Security Incident affecting a customer's Customer Data, we notify that customer without undue delay and no later than seventy-two (72) hours after confirmation, give a preliminary notice where an investigation of a suspected incident remains open after five business days, provide the information reasonably available to us about the nature and scope of the incident, and cooperate with the customer's own notification obligations, consistent with the Data Processing Addendum.

Backup and Continuity

The Customer Data held in our relational databases is backed up daily; backups are encrypted, immutable, stored in the United States, and retained for seven (7) years. Files uploaded to the service are held in redundant cloud object storage but are not currently included in backup snapshots, so customers should retain their own copies of uploaded files.

We conduct a disaster recovery exercise at least annually, including restoration from backups, to confirm that Customer Data can be recovered and to measure recovery time.

Customers can also export their Customer Data at any time during the term using the export functions in the service, as described in Section 8 of the Terms and Conditions, and we recommend that customers maintain their own source records as their record retention laws require.

Personnel Security

Reason personnel with access to production systems or Customer Data undergo background checks in accordance with applicable law before they are hired.

All personnel and contractors who may access Customer Data are bound by written confidentiality obligations that cover confidential tax and assessment information.

Personnel complete security and privacy awareness training when they join Reason and at least annually thereafter, with additional training for those who handle Customer Data or operate production systems.

Compliance and Assurance

Reason completes a SOC 2 Type II examination annually and maintains ISO 27001 certification, and the scope of each covers Reason Consulting Corporation as a whole, including the Services; our current SOC 2 Type II report and ISO 27001 certificate are available to customers on request, subject to reasonable confidentiality protections consistent with the customer's public records law, including any exemption for security information. We also complete customer security questionnaires, respond to procurement security requirements, and describe our security posture in further detail on request.

Because Audit Aware processes tax and assessment records that are confidential under state and federal law, we design our controls with those confidentiality requirements in mind and will work with customers to document how our practices map to the specific statutes and safeguarding requirements that apply to them.

The hosting provider's independent assurance reports covering physical and infrastructure controls can be made available to customers under the provider's terms.

Vulnerability Reporting

If you believe you have found a security vulnerability in Audit Aware, please report it to contact@reason.consulting with enough detail for us to reproduce the issue, and we will acknowledge your report and keep you informed as we investigate.

We will not pursue action against a person solely for reporting in good faith a vulnerability they encountered in ordinary use. Security testing of the production service is not authorized without our prior written agreement; contact us at contact@reason.consulting to arrange authorized testing.

Questions

Questions about this Security Overview or requests for additional security documentation may be directed to the address below.

Reason Consulting Corporation, 2820 Selwyn Ave, STE 856, Charlotte, NC 28209, United States; email contact@reason.consulting.