AuditnQ Security Whitepaper

How Rendering Consulting Inc. Protects Customer Data and Systems.

Master copy

This repository is the authoritative source for this whitepaper. Propose changes via a pull request targeting this file. The Google Doc copy and any distributed PDF must be regenerated from this file after each update.

Field	Value
Version	1.2
Published	April 2026
Last updated	2026-04-19
Classification	Public
Audience	Customers, prospects, and partners
Owner	CEO

1. Executive Summary

Rendering Consulting Inc. ("Rendering Consulting") is committed to protecting customer data and maintaining the highest standards of information security. This whitepaper describes the security architecture, controls, and practices employed by AuditnQ, our cloud-based Third-Party Risk Management (TPRM) system.

AuditnQ is built on Microsoft Azure and leverages industry-standard security measures including encryption in transit and at rest, strong identity and access management through Auth0, strict tenant isolation at the database and storage layers, and a secure software development lifecycle. Rendering Consulting is certified under ISO/IEC 27001 (ISMS) and is currently pursuing SOC 2 Type II certification to further demonstrate our commitment to security, availability, and confidentiality.

2. Product Overview

AuditnQ is a SaaS-based Third-Party Risk Management (TPRM) system designed to streamline vendor audit and compliance management. The platform enables organizations to create and manage audit questionnaire formats, distribute questionnaires to vendors and collect responses, track audit progress and review vendor compliance status, and compare and analyze vendor responses across audit cycles.

3. Security Governance and Risk Management

Rendering Consulting operates a documented information security management system (ISMS) certified under ISO/IEC 27001. Security governance is exercised by executive leadership, with the CEO accountable for the information security program.

3.1 Policy Framework

A layered set of information security policies defines our control environment, including (but not limited to) policies covering human resource security, third-party management, code of conduct, access control, cloud service usage, and incident response. Policies are endorsed by executive leadership and reviewed at least annually, with interim updates published when significant changes occur.

3.2 Roles and Responsibilities

Information security roles and responsibilities are formally defined and communicated through written job descriptions, policies, and onboarding materials. Managers are responsible for ensuring that personnel are aware of, and comply with, applicable policies throughout their employment or engagement. Adherence to information security responsibilities is evaluated as part of performance reviews where applicable.

3.3 Risk Management

We maintain an ongoing risk management program that identifies, evaluates, and treats information and technology risks at strategic and operational levels. Risk assessments inform decisions about control design, third-party engagement, and platform changes, and are reviewed at least annually.

3.4 Policy Exceptions and Enforcement

Exceptions to any information security policy require written approval by the CEO or a designated delegate. Known policy violations are reported to the CEO and may result in immediate suspension or revocation of system and network privileges, as well as disciplinary action up to and including termination of employment.

4. People Security

Rendering Consulting applies human resource security controls to ensure that personnel and contractors meet security requirements, understand their responsibilities, and are suitable for their roles.

4.1 Pre-employment Screening

Background checks are performed in accordance with applicable laws and regulations, and are proportionate to business need, the data classification involved, and the anticipated risk of the role. Executive leadership and other critical positions with broad access to sensitive data or systems include criminal history checks, conducted under applicable Japanese law with prior written consent. Third parties with privileged or administrative access to production systems are subject to equivalent background checks or acceptable evidence thereof. Competency assessments (including verification of education and qualifications, technical tests, and interviews) are performed as part of the hiring process. Reference checks, where conducted, are limited to executive and other critical positions and are performed within the scope permitted by applicable Japanese law.

4.2 Terms of Employment and Confidentiality

Information security responsibilities are communicated to employees and third parties at the start of employment or engagement. Personnel with access to company or customer information are required to acknowledge their security responsibilities and sign appropriate confidentiality, non-disclosure, and code of conduct agreements.

4.3 Security Awareness Training

All employees, and all third parties with administrative or privileged technical access to production systems, complete information security awareness training at onboarding and at least annually thereafter. Additional, role-appropriate training is provided for personnel with responsibilities for sensitive data handling or privacy. Managers monitor training completion and take corrective action where needed.

4.4 Code of Conduct

All personnel are expected to uphold Rendering Consulting's code of conduct, which defines acceptable workplace behavior, prohibits harassment and discrimination, and establishes confidential reporting channels for suspected violations. A whistleblower channel is publicly available on our corporate website, and concerns may also be raised directly with the CEO or, when the concern involves the CEO, with external legal counsel or HR advisors. Retaliation against individuals who report concerns or participate in investigations in good faith is strictly prohibited and is itself a violation of the code of conduct.

4.5 Termination and Offboarding

On termination or end of engagement, physical and logical access are revoked promptly in accordance with internal SLAs, and company-issued equipment is returned. Post-termination obligations, including surviving confidentiality and security commitments, are reiterated to the departing individual.

4.6 Disciplinary Process

Violations of information security policies are handled through a progressive disciplinary process, which may include termination of employment or contract.

5. Infrastructure Security

5.1 Cloud Platform

AuditnQ is hosted entirely on Microsoft Azure, leveraging the following managed services:

Azure Static Web Apps: Hosts the web application frontend with built-in global distribution and SSL/TLS termination
Azure Functions: Provides the serverless API backend, automatically scaling based on demand
Azure Database for PostgreSQL Flexible Server: Managed relational database service with built-in high availability
Azure Storage (Data Lake Gen2): Secure object storage for documents and attachments
Azure Application Insights: Application performance monitoring and diagnostics

5.2 Network Security

All external communications are encrypted using TLS 1.2 or higher. Azure's built-in network security features, including DDoS protection and Web Application Firewall capabilities, protect the infrastructure from common network-based threats.

5.3 Data Residency

All customer data is stored within Microsoft Azure's Japan regions (Japan East / Japan West), ensuring data residency within Japan. No customer data is transferred to or stored in regions outside of Japan.

6. Data Handling and Privacy

6.1 Data Classification

Customer data within AuditnQ falls into the following categories:

Account data: Organization and user profile information managed through Auth0
Audit data: Questionnaire formats, projects, responses, and audit results stored in tenant-specific databases
Attachments: Documents uploaded by users, stored in tenant-specific storage containers

6.2 Data Isolation

AuditnQ employs a strict multi-tenant architecture with data isolation at multiple levels:

Database isolation: Each tenant is provisioned with a dedicated PostgreSQL database, ensuring complete logical separation of audit data between organizations
Storage isolation: Each tenant's file attachments are stored in dedicated storage containers with tenant-specific access controls
Identity isolation: Auth0 Organizations provide tenant-level identity boundaries

6.3 Data Retention and Deletion

Customer data is retained for the duration of the service agreement. Logical deletion (soft delete) is implemented across the platform, and data can be permanently removed upon customer request in accordance with applicable data protection requirements.

6.4 Privacy and Regulatory Alignment

AuditnQ is designed for customers operating under Japanese and international privacy requirements. Our practices are aligned with the Act on the Protection of Personal Information (APPI, 個人情報保護法) of Japan, and we take into account internationally recognized frameworks such as the EU General Data Protection Regulation (GDPR) when relevant to customer engagements. A Data Processing Addendum (DPA) is available upon request for customers who require one. Customer data is processed only for the purposes of providing and improving the AuditnQ service, consistent with contractual commitments.

7. Encryption

7.1 Encryption in Transit

All data transmitted between clients and AuditnQ services is encrypted using TLS 1.2 or higher. This includes:

Web application traffic (HTTPS)
API communications between frontend and backend
Database connections (SSL-encrypted PostgreSQL connections)

7.2 Encryption at Rest

Database: Azure Database for PostgreSQL provides transparent data encryption at rest using Azure-managed keys
Storage: Azure Storage encrypts all data at rest using 256-bit AES encryption
Tenant credentials: Sensitive tenant configuration data, including database connection credentials, is encrypted using AES-256 encryption with industry-standard key derivation before storage

7.3 Key Management

Encryption keys for infrastructure-level encryption are managed by Microsoft Azure's key management infrastructure. Application-level encryption keys for tenant credential protection use a multi-layer approach with dedicated key derivation per tenant.

8. Identity and Access Management

8.1 Authentication

AuditnQ uses Auth0 as its Identity Provider (IdP), providing:

Industry-standard OAuth 2.0 / OpenID Connect protocols
JWT-based authentication with RS256 signing algorithm
Token verification against Auth0's JWKS (JSON Web Key Set) endpoint
Enterprise Single Sign-On (SSO) support through Auth0 connections (available upon request)

8.2 Authorization and Role-Based Access Control

Access control is enforced through Auth0 Organizations with role-based permissions:

Tenant Owner: Full administrative control over the organization's AuditnQ instance
Admin: Administrative privileges within the organization
Standard users: Access scoped to assigned projects and audit functions

Every API request passes through mandatory authentication and authorization middleware before reaching business logic, ensuring no unauthenticated or unauthorized access to protected resources. Additionally, AuditnQ supports IP allowlisting, enabling organizations to restrict access to the platform from approved network addresses only.

8.3 Session Management

User sessions are managed through Auth0 with configurable session timeouts. Refresh tokens enable seamless session renewal while maintaining security controls.

8.4 Internal Access Management (Company Personnel)

Internal access by Rendering Consulting personnel to production systems that host customer data is governed by a documented access request workflow. The workflow enforces the following principles:

Onboarding-first: access to production systems is not granted until the individual has completed HR onboarding, including execution of employment and confidentiality agreements and acknowledgment of information security policies.
Least privilege: access is limited to what is required to perform the individual's role.
Start date: access is never provisioned before the official employment or engagement start date.
Approval required: every access grant requires explicit approval from the relevant system or data owner, or a designated manager.
Prompt revocation: access is revoked on termination or change of role in accordance with internal SLAs.

Access requests, approvals, and grants are retained as evidence for audit purposes.

9. Tenant Isolation Architecture

AuditnQ's multi-tenant architecture provides strong isolation guarantees across all layers of the application stack.

9.1 Tenant Resolution

Each tenant is identified through a unique identifier. Every request is resolved to the appropriate tenant context, ensuring that it is routed to the correct tenant-specific resources.

9.2 Database Isolation

Each tenant operates on a dedicated PostgreSQL database. Database connection credentials are encrypted with tenant-specific keys, preventing cross-tenant data access even at the infrastructure level.

9.3 Storage Isolation

File storage is partitioned using tenant-specific containers in Azure Data Lake Gen2. Access to stored files is controlled through time-limited Shared Access Signatures (SAS) with short expiration periods, minimizing the window of exposure for any individual access token.

9.4 Audit Trail

All data modifications are automatically tracked with the identity of the user who performed the action, providing a comprehensive audit trail for compliance and forensic purposes.

10. Secure Development Practices

10.1 Input Validation

AuditnQ employs comprehensive input validation using a strictly-typed schema validation library. All API inputs are validated against strictly defined schemas before processing, preventing injection attacks and ensuring data integrity. Validation rules are shared between client and server, providing consistent enforcement at both layers.

10.2 API Security

The API layer is built on a type-safe remote procedure call framework that:

Enforces strict type contracts between client and server
Applies authentication and authorization middleware to every procedure
Validates all input parameters through schema-based validation
Provides end-to-end type safety from database to user interface

10.3 Dependency Management

The project uses centralized dependency management. Dependencies are regularly reviewed and updated to address known vulnerabilities.

10.4 Code Review and Version Control

All code changes undergo peer review before deployment to production environments through version-controlled workflows on GitHub. Changes are tracked, reviewed, and approved through pull requests to maintain code quality and security.

10.5 Change Management

Changes to production systems follow a controlled change management process. Non-production (development, staging) and production environments are logically separated, with production access and deployment rights limited to authorized personnel. All code changes are peer-reviewed and tracked through version-controlled pull requests on GitHub before merge, and deployments are performed through automated, auditable pipelines. Emergency changes follow an expedited review path with after-the-fact documentation and sign-off.

10.6 Vulnerability Management and Responsible Disclosure

Rendering Consulting maintains a vulnerability management program covering the AuditnQ platform and its dependencies:

Dependencies are monitored continuously for known vulnerabilities, with patches prioritized according to severity.
Platform updates and security patches are applied on a regular cadence, with critical fixes expedited.
Application and infrastructure configurations are reviewed periodically against baseline security standards.
Security testing is performed in connection with major releases; where warranted, independent third-party assessments are commissioned.

If you believe you have discovered a security vulnerability in AuditnQ, we ask that you report it to the contact address in the Contact Information section. We appreciate responsible disclosure and will coordinate on remediation and public communication as appropriate.

11. Logging and Monitoring

11.1 Application Monitoring

Azure Application Insights: Provides real-time application performance monitoring, error tracking, and diagnostics
Sentry: Frontend error monitoring and reporting for rapid issue identification and resolution

11.2 Audit Logging

Auth0 audit logs capture authentication events, including successful and failed login attempts, per tenant
Database-level audit fields track data modifications with user attribution

11.3 Infrastructure Monitoring

Azure's built-in monitoring capabilities provide infrastructure-level visibility, including resource utilization, availability metrics, and security event detection.

12. Incident Response

Rendering Consulting maintains an incident response process to address security events promptly:

Detection: Automated monitoring and alerting through Application Insights and Azure Security Center
Assessment: Security incidents are classified by severity and potential impact
Containment: Immediate measures to limit the scope and impact of confirmed incidents
Notification: Affected customers are notified in accordance with contractual obligations and applicable regulations
Remediation: Root cause analysis and corrective actions to prevent recurrence
Documentation: All incidents are documented for review and continuous improvement

For security inquiries or to report a vulnerability, please contact our security team at the address provided in the Contact Information section.

13. Business Continuity and Disaster Recovery

Rendering Consulting maintains business continuity and disaster recovery practices designed to preserve the availability and integrity of the AuditnQ service in the event of infrastructure disruption.

Backup: Managed backups of Azure Database for PostgreSQL are retained with point-in-time restore capability; Azure Storage data is protected by the durability guarantees of the underlying platform.
High availability: Managed Azure services used by AuditnQ provide built-in high availability within the selected region.
Regional strategy: Customer data is stored in Microsoft Azure's Japan regions (Japan East / Japan West). Regional diversity is leveraged to mitigate the impact of localized service disruption.
Recovery objectives: Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets are defined internally and reviewed as the platform evolves; specific targets are available to customers under a non-disclosure agreement where required.
Testing: Recovery procedures are reviewed and exercised periodically to validate effectiveness.

14. Third-Party Risk Management and Subprocessors

14.1 Program Overview

Rendering Consulting maintains a third-party risk management program that governs the selection, onboarding, and ongoing oversight of suppliers, service providers, and other third parties that process customer data or impact the security of the AuditnQ platform.

Due diligence is performed before granting access to confidential data, systems, or networks.
Written agreements are maintained with all suppliers that can access production systems or impact the security of the production environment. These agreements address confidentiality, integrity, availability, and privacy obligations.
A vendor inventory is maintained that documents the security posture of critical third-party service providers and is reviewed at least annually.
Material changes to supplier services are assessed for risk, and contractual or configuration changes are made as needed.

14.2 Cloud Services

For cloud service providers, Rendering Consulting is responsible for all customer-side controls defined in the provider's shared responsibility matrix. Agreements with cloud service providers specify protections for Rendering Consulting's data and service availability. Where possible, we seek advance notice of substantive changes in service delivery, including changes to technical infrastructure, data storage location, or use of sub-processors. Risks related to vendor lock-in and exit are assessed as part of vendor review prior to acquisition.

14.3 Key Subprocessors

The following subprocessors support the delivery of AuditnQ. This list is indicative; the current authoritative list is maintained internally and available to customers upon request.

Microsoft Azure — hosting, managed database, object storage, and operational monitoring (Japan East / Japan West).
Auth0 by Okta — identity provider for authentication, organization management, and authorization.
Sentry — frontend error monitoring and diagnostics.

We notify customers of material changes to our subprocessor set in accordance with contractual commitments.

14.4 Third-Party Security Expectations

Third parties that receive, process, or store confidential data, or that have access to Rendering Consulting resources, are expected to maintain, as applicable to the service they provide:

An information security policy endorsed by executive management and reviewed regularly.
A risk assessment and treatment program covering information and technology risks.
Operational security controls, including protection against malicious software, network protection, technical vulnerability management, logging and monitoring, incident response, and business continuity.
A technical access control program.
A secure software and systems development program.
Physical and environmental security controls where confidential data is stored or processed.
Human resource controls, including background checks for personnel with access to confidential information.
Compliance with applicable laws and regulations, including those related to the protection of records and personally identifiable information (PII).

15. Compliance Posture

Rendering Consulting is certified under ISO/IEC 27001 (ISMS) and is actively pursuing additional compliance certifications to demonstrate our commitment to security:

ISO/IEC 27001 (ISMS): Rendering Consulting Inc. is certified under ISO/IEC 27001, the international standard for information security management systems, demonstrating a systematic approach to managing sensitive company and customer information.
SOC 2: Rendering Consulting is currently preparing for SOC 2 Type II certification, with controls designed around the Trust Services Criteria for Security, Availability, and Confidentiality.
Azure Compliance: AuditnQ is deployed on Microsoft Azure, which maintains a comprehensive set of compliance certifications including SOC 1/2/3, ISO 27001, ISO 27018, and more.

We are committed to transparency and will update this document as our compliance posture evolves.

16. Shared Responsibility Model

Security is a shared responsibility between Rendering Consulting and our customers.

Rendering Consulting is responsible for:

Security of the AuditnQ platform and infrastructure
Encryption of data in transit and at rest
Access control enforcement and tenant isolation
Incident detection, response, and notification
Regular security assessments and platform updates

Customers are responsible for:

Managing user accounts and access permissions within their organization
Protecting their authentication credentials
Ensuring appropriate use of the platform in compliance with their own policies
Reporting suspected security issues promptly

17. Contact Information

For security-related inquiries:

Rendering Consulting Inc.
Email: contact@ren-con.jp
Website: https://ren-con.jp/

18. Revision History

Version	Date	Summary of changes	Approver
1.1	2026-04-18	Established the Markdown master in this repository as the authoritative source (English; Japanese translation added on the same day).	CEO
1.2	2026-04-19	Updated product classification and terminology. Refined content for clarity. Updated owner. Added revision history.	CEO