A technical overview for firms evaluating the platform, how engagements are designed around AICPA attestation standards, how client data is isolated and secured, and how the software itself is built, reviewed, and deployed.
Audentic Engage is a cloud-based platform built specifically for CPA firms performing SOC 2 examinations. It covers the full engagement lifecycle in one system: setting up an engagement and scoping controls against the Trust Services Criteria, requesting and collecting evidence from the client, testing that evidence and documenting the test procedure and conclusion, tracking exceptions and management responses, and producing a client-facing view of where the engagement stands.
The sections below describe how the platform is designed to operate, how client data is protected, and how the software itself is built and shipped.
The testing workflow is modeled directly on how a real audit engagement team executes work, including preparer and manager review, and partner accountability, with the same preparer-before-reviewer sign-off discipline and documentation trail that AICPA attestation standards are built around, whether a given test was performed by a person or AI-assisted.
For each in-scope control, evidence is read and an initial test procedure and conclusion are drafted by a first-pass preparer, today this step is AI-assisted, performing the same read-the-evidence, draft-the-conclusion task a staff or senior associate auditor would. That draft is then independently reviewed against the underlying evidence for logical soundness and completeness by a second agentic reviewer, which either approves it or sends structured, specific notes back for revision, the same back-and-forth a manager’s review notes produce in a traditional engagement. If the testing of a control can’t be resolved through that review cycle, it doesn’t get silently resolved, it’s flagged for direct human partner attention instead.
Firms retain full editorial control: any AI-drafted conclusion is editable before sign-off, the underlying evidence and decision stay fully visible, and a firm can customize the instructions guiding AI testing on a per-engagement basis. Each firm’s AI usage is also logged, including feature, model, token counts, and timestamp, so testing activity is bounded and auditable, not open-ended automation.
Client and engagement data for every firm lives in the same managed database, and isolation between firms is enforced by the database itself.
Nothing is tested against actual client data. Staging and production run on entirely separate infrastructure, not a shared database with a flag.
Audentic Engage was built by a licensed CPA with certified information technology professional and CISA credentials. Audit methodology and security weren’t bolted on after the fact; they were the starting point.
All source code lives in a private, version-controlled GitHub repository. Every change, who authored it, and when, is permanently recorded and cannot be altered after the fact. Changes flow through a structured branch workflow: a feature branch, merged into a shared staging branch for testing, promoted to production only through a reviewed pull request. No change reaches production, and therefore a firm’s live data, without first passing through staging and receiving explicit human review and approval for that promotion.
Every deployable change is versioned and logged in a permanent, human-readable changelog describing exactly what changed and why, alongside the underlying git history, giving a complete audit trail of the platform’s own evolution, not just the data running on it.
Audentic Engage, including the application, database, and file storage, doesn’t run on self-managed servers, it runs on named, independently operated cloud infrastructure.
Backups, redundancy, and physical/operational infrastructure security for the database and hosting layer are managed by Supabase and Railway as part of their own operational controls, see “Vendor oversight” below. We have not yet completed our own independently audited availability or incident-response SLA. Provider-level detail (backup frequency, recovery objectives, incident procedures) is documented in each vendor’s own SOC 2 report and can be made available on request.
Agentic testing is powered by Anthropic’s Claude models, used specifically for evidence-sufficiency review and test-conclusion drafting described above.
Model calls are made server-side using an API credential that is never exposed to the browser, over an encrypted (HTTPS/TLS) connection to Anthropic’s API, the same encryption used everywhere else in the platform. Under Anthropic’s standard commercial API terms, data sent to Claude through the API is never used to train Anthropic’s models. Ever.
Every AI call is logged, including feature, model used, token counts, and timestamp, both for cost transparency to the firm and as part of the documentation trail described in “Testing methodology” above. Each firm can also configure which Claude model tier is used at each stage of testing.
Audentic has not yet completed its SOC 2 examination; however, its core infrastructure and AI providers have: Supabase, Railway, GitHub, and Anthropic each maintain an independently audited SOC 2 Type 2 examination report. As part of our ongoing vendor risk management program, those reports are reviewed annually, the same standard we’d expect a client to hold their own critical vendors to.
If your firm’s due-diligence or vendor-risk process needs more detail than covered here, including current vendor SOC 2 reports, reach out to compliance@audentic.io.