Quick Actions

Your First 15 Minutes

1. 1✅ Create Organization (/onboarding) — Set up your organization, industry, and company size in the 3-step onboarding wizard.
2. 2👥 Invite Team Members (/settings/team) — Add teammates and assign roles: owner, admin, compliance_manager, security_manager, procurement_manager, member, viewer.
3. 3🏢 Add Your First Vendor (/vendors → New Vendor) — Create a vendor record with name, website, category, and risk level.
4. 4📋 Select Compliance Framework (/compliance/frameworks → New) — Choose from ISO 27001, SOC 2, DPDP, PCI DSS, HIPAA.
5. 5📎 Upload Evidence (/compliance/evidence → New Evidence) — Attach evidence items and map them to controls.
6. 6📊 Review Dashboard (/dashboard) — See your Org Trust Score™, compliance readiness, and open risks at a glance.

Platform Overview

AUDT replaces spreadsheets and disconnected tools with a single AI-native platform for vendor governance, compliance, audits, risk, and board governance. Every action flows into a unified trust posture that is continuously scored, monitored, and reported.

Vendor Lifecycle

Compliance Lifecycle

Scoring Engines

Trust Score™ Deep Dive

The Vendor Trust Score™ is a 0–100 composite signal computed from 7 weighted components. It updates on every meaningful governance action — document upload, assessment completion, risk change, contract update. A score ≥ 90 is Trusted. Below 60 is High Concern.

Score Levels

Components & How to Improve Them

Trust Operations Engine™

The Trust Operations Engine™ (TOE) is the orchestration layer that connects every governance module into an automated, event-driven platform. It transforms AUDT from a record-keeping system into a proactive governance intelligence platform that closes the loop on every governance signal.

The Four Layers

1. 1Event Engine — 37 built-in event types. Every vendor action, risk change, evidence expiry, and compliance gap triggers an event automatically.
2. 2Workflow Engine — 6 built-in workflows: Vendor Onboarding, Evidence Expiry Response, Trust Score Drop, Contract Renewal, Vendor Offboarding, Critical Risk Escalation. Plus custom workflows via /operations/workflows.
3. 3Automation Engine — No-code if-this-then-that rules. Connect any event to any action: create risk, assign task, request evidence, send notification, escalate for approval.
4. 4AI Decision Engine — AI generates recommendations with confidence scores and suggested actions. All proposed mutations require human approval at /operations/approvals — no autonomous data changes.

Core GRC

Intelligence

Privacy & Legal

Operations

Trust Network

Enterprise

Templates & Checklists

Downloadable templates to accelerate your governance program. New templates are added regularly.

Executive Insights

How AI Agents Work

All agents follow a four-stage lifecycle designed around human-in-the-loop governance. Agents observe, reason, and recommend — but they never mutate data without an explicit human approval.

Governance Agent Framework™

Six purpose-built agents monitor your governance posture continuously. Each agent has a defined module scope, configurable thresholds, and an execution schedule. Manage them at /agents.

Module AI Assistants

Every AUDT module has a dedicated AI assistant powered by Google Gemini 2.5 Flash. These assistants provide on-demand analysis, cached executive summaries, and multi-turn NL chat — accessible from each module's AI tab.

Agent Lifecycle & Pages

The Governance Agent Framework™ spans 10 pages under /agents:

Authentication

AUDT uses Bearer token authentication. Create API keys at /settings/api-keys. Two permission levels are available: read_only and read_write. Keys are shown once at creation and stored as a bcrypt hash.

Rate Limits

Key Endpoints

Error Handling

All errors return JSON with an error field. HTTP status codes follow REST conventions.

// AUDT API error response format:
// { "error": "string description", "code": "ERROR_CODE" (optional) }

// HTTP status codes:
// 200  OK
// 201  Created
// 400  Bad Request — invalid body, missing required fields
// 401  Unauthorized — missing or invalid Bearer token
// 403  Forbidden — key lacks required permission (read_write needed for POST/PUT/DELETE)
// 404  Not Found — resource does not exist in your organisation
// 422  Unprocessable Entity — valid JSON but business rule violation
// 429  Too Many Requests — rate limit exceeded (see Retry-After header)
// 500  Internal Server Error — contact support@audt.tech

// Rate limit headers on every response:
// X-RateLimit-Limit: 100
// X-RateLimit-Remaining: 87
// X-RateLimit-Reset: 1720000060

// Retry-After on 429:
// Retry-After: 60  (seconds)

// Example: robust fetch with retry
async function audtFetch(url, options = {}) {
  const res = await fetch(url, {
    ...options,
    headers: { Authorization: `Bearer ${AUDT_KEY}`, ...options.headers },
  });
  if (res.status === 429) {
    const wait = parseInt(res.headers.get("Retry-After") ?? "60", 10);
    await new Promise(r => setTimeout(r, wait * 1000));
    return audtFetch(url, options);
  }
  if (!res.ok) {
    const err = await res.json().catch(() => ({}));
    throw new Error(err.error ?? `AUDT API ${res.status}`);
  }
  return res.json();
}

cURL Examples

# Get Org Trust Score
curl -H "Authorization: Bearer tap_your_key" \
  https://audt.tech/api/v1/trust-intelligence/org-score

# Create a Risk
curl -X POST -H "Authorization: Bearer tap_your_key" \
  -H "Content-Type: application/json" \
  -d '{"title":"Vendor data breach risk","category":"cyber_security","impact":4,"likelihood":3}' \
  https://audt.tech/api/v1/risks

# Get Vendor Trust Score
curl -H "Authorization: Bearer tap_your_key" \
  https://audt.tech/api/v1/vendors/{id}/trust-score

JavaScript / TypeScript

No SDK required — use native fetch or any HTTP client. The API returns JSON on every endpoint.

// Install: no SDK needed — use fetch or axios

const AUDT_KEY = process.env.AUDT_API_KEY; // tap_...
const BASE = "https://audt.tech";

// Get Org Trust Score
async function getOrgTrustScore() {
  const res = await fetch(`${BASE}/api/v1/trust-intelligence/org-score`, {
    headers: { Authorization: `Bearer ${AUDT_KEY}` },
  });
  const data = await res.json();
  // data.score: number, data.level: string, data.components: object
  return data;
}

// Create a Risk
async function createRisk(title, category, impact, likelihood) {
  const res = await fetch(`${BASE}/api/v1/risks`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${AUDT_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ title, category, impact, likelihood }),
  });
  return res.json(); // { id, title, score, ... }
}

// Get Vendor Trust Score with history
async function getVendorTrustScore(vendorId) {
  const res = await fetch(`${BASE}/api/v1/vendors/${vendorId}/trust-score`, {
    headers: { Authorization: `Bearer ${AUDT_KEY}` },
  });
  return res.json();
  // .score, .level, .components, .history (30 days), .narrative
}

// List open risks (filter by status + category)
async function getOpenRisks() {
  const params = new URLSearchParams({ status: "open", category: "cyber_security" });
  const res = await fetch(`${BASE}/api/v1/risks?${params}`, {
    headers: { Authorization: `Bearer ${AUDT_KEY}` },
  });
  return res.json(); // { data: Risk[], meta: { page, total } }
}

Python

Use the requests library. All endpoints return JSON dictionaries matching the TypeScript types.

import os, requests

AUDT_KEY = os.environ["AUDT_API_KEY"]  # tap_...
BASE = "https://audt.tech"
HEADERS = {"Authorization": f"Bearer {AUDT_KEY}"}

# Get Org Trust Score
def get_org_trust_score():
    r = requests.get(f"{BASE}/api/v1/trust-intelligence/org-score", headers=HEADERS)
    r.raise_for_status()
    return r.json()  # { score, level, components }

# Create a Risk
def create_risk(title, category, impact, likelihood):
    payload = {"title": title, "category": category,
               "impact": impact, "likelihood": likelihood}
    r = requests.post(f"{BASE}/api/v1/risks", json=payload, headers=HEADERS)
    r.raise_for_status()
    return r.json()  # { id, title, score, ... }

# Get all frameworks with readiness
def get_frameworks():
    r = requests.get(f"{BASE}/api/v1/compliance/frameworks", headers=HEADERS)
    r.raise_for_status()
    return r.json()  # [{ id, name, readinessScore, controlCount }]

# Paginate through vendors
def get_all_vendors():
    vendors, page = [], 1
    while True:
        r = requests.get(f"{BASE}/api/v1/vendors?page={page}&pageSize=50",
                         headers=HEADERS)
        data = r.json()
        vendors.extend(data["data"])
        if page >= data["meta"]["totalPages"]:
            break
        page += 1
    return vendors

Webhooks

Register webhooks at /trust-api/webhooks. AUDT delivers a POST to your endpoint for each subscribed event. Expects a 200 response within 10 seconds, then retries.

// Register a webhook at /trust-api/webhooks
// AUDT delivers POST to your endpoint for each subscribed event.

// 1. Verify the payload (check x-audt-signature header)
// 2. Process the event type
// 3. Return 200 OK within 10 seconds (AUDT retries on timeout)

// Node.js webhook handler (Express)
app.post("/audt-webhook", express.raw({ type: "application/json" }), (req, res) => {
  const event = JSON.parse(req.body.toString());

  switch (event.event_type) {
    case "trust_score.dropped":
      // event.data: { vendor_id, old_score, new_score, delta }
      console.log("Trust score dropped for", event.data.vendor_id);
      break;

    case "evidence.expired":
      // event.data: { evidence_id, vendor_id, expired_at }
      notifyTeam("Evidence expired: " + event.data.evidence_id);
      break;

    case "risk.critical":
      // event.data: { risk_id, title, score, vendor_id }
      escalateRisk(event.data);
      break;
  }

  res.status(200).json({ received: true });
});

// Available event types:
// trust_score.dropped  trust_score.improved  evidence.expired
// evidence.expiring_soon  risk.critical  vendor.status_changed
// contract.expiring  capa.overdue  audit.completed

Trust Score API

The Trust Score endpoints return structured breakdowns useful for embedding in external dashboards, SIEM integrations, or BI tools.

// Vendor Trust Score™ — full breakdown
GET /api/v1/vendors/{id}/trust-score

Response:
{
  "score": 82,
  "level": "Strong",       // Exceptional | Trusted | Strong | Moderate | Needs Attention | High Concern
  "components": {
    "evidence":     { "score": 75, "weight": 0.20, "weighted": 15.0 },
    "risk":         { "score": 85, "weight": 0.20, "weighted": 17.0 },
    "compliance":   { "score": 80, "weight": 0.15, "weighted": 12.0 },
    "assessment":   { "score": 90, "weight": 0.15, "weighted": 13.5 },
    "contract":     { "score": 70, "weight": 0.10, "weighted": 7.0 },
    "operational":  { "score": 80, "weight": 0.10, "weighted": 8.0 },
    "freshness":    { "score": 90, "weight": 0.10, "weighted": 9.0 }
  },
  "history": [          // last 30 daily snapshots
    { "date": "2026-06-28", "score": 82 },
    { "date": "2026-06-27", "score": 79 }
  ],
  "narrative": "Vendor X maintains a Strong trust posture...",
  "strengths": ["Assessment score 90/100", "Evidence up to date"],
  "concerns":  ["Contract expires in 45 days", "2 open risks"]
}

// Org Trust Score™
GET /api/v1/trust-intelligence/org-score

Response:
{
  "score": 74,
  "level": "Moderate",
  "components": {
    "vendorTrust":         { "score": 78, "weight": 0.25, "weighted": 19.5 },
    "riskPosture":         { "score": 70, "weight": 0.25, "weighted": 17.5 },
    "controlHealth":       { "score": 75, "weight": 0.20, "weighted": 15.0 },
    "auditReadiness":      { "score": 65, "weight": 0.15, "weighted": 9.75 },
    "complianceCoverage":  { "score": 80, "weight": 0.15, "weighted": 12.0 }
  }
}

Integrations

35+ connectors across 11 categories. Phase 1 connectors cover ~80% of prospect requirements.

Phase 1 Connectors

How to Connect

Go to /integration-hub/marketplace → click connector → Configure → enter credentials → Test Connection → Save. Credentials are stored AES-256-GCM encrypted.

Categories