How Auditbench handles personal data

Auditbench is a bank statement analysis workbench for accounting and audit firms. It is provided by Zenaclove IT Solutions (“Zenaclove”, “we”, “us”). This notice explains what personal data Auditbench handles, why, where it is held, and what you can ask of us.

We handle personal data in line with the Nigeria Data Protection Act 2023 (the NDPA). Because Auditbench runs on infrastructure in Ireland, we also apply the standards of the EU General Data Protection Regulation (the GDPR). Questions about this notice go to support@auditbench.app.

Account data is about the people who use Auditbench: the partners and staff a firm invites. We decide how it is used to run the service, so for this data Zenaclove is the controller.

Client data is what a firm uploads about its clients — bank statements, ledgers and trial balances — and what Auditbench derives from it. Bank narrations routinely name individuals: a client’s staff, customers, suppliers and family. The firm decides what is uploaded and why, so the firm is the controller, and Zenaclove processes the data only on the firm’s instructions, as its processor. The data processing annex of our Terms governs that processing.

If you are named in a bank statement or ledger a firm has uploaded, the firm is the organisation responsible for it; see Your rights below.

Account data

• Your name, email address, and the firm and role you were invited to.
• Your password, which we never see in readable form: our authentication provider stores only a one-way hash of it.
• A record of what you do in the product. Every change to engagements, periods, statements, transactions, classifications, members and roles is written to the firm’s audit trail with the email address and role of the person who made it.
• The version of the Terms and this notice you accepted, and when.

Client data

• Statement files as uploaded (PDF, XLS, XLSX or CSV).
• The transactions read from them: dates, narrations, amounts, balances, account names and numbers, and counterparties.
• What the firm produces from them: classifications, review decisions, reconciliations, notes and reports.
• Ledgers and trial balances, where the firm uploads them.

Enquiries

When you use the contact form or apply for an account, we keep the details you enter and a one-way hash of your IP address. The hash is used only to limit abuse of the forms.

Error reports

When something fails, we record the error, where in the application it happened, and the internal identifiers of the user and firm involved. Error reports are built to leave out email addresses, narrations, amounts, file contents, passwords and tokens.

• Providing the service to your firm — accounts, sign-in, access control and the workbench itself. Basis: performing our agreement with your firm, and our legitimate interest in providing the service to the people it invites.
• Transactional email — invitations, password recovery, and notices about reviews, locked periods and exports. Basis: performing that agreement.
• Keeping the service secure and working — the audit trail, error reports and limits on the public forms. Basis: our legitimate interest in a secure, reliable service; the audit trail also supports the firm’s own record-keeping obligations.
• Answering enquiries and applications. Basis: steps you asked us to take before any agreement, and our legitimate interest in replying.
• Client data is used only to provide the service to the firm that uploaded it, on that firm’s instructions. The legal basis for processing it is the firm’s to establish — typically its legal obligations and its legitimate interest in carrying out the engagement.

We do not sell personal data, use it for advertising, or use client data for any purpose of our own, including training models or building products for others.

Auditbench suggests a category for each transaction from keyword rules the firm controls, and applies a suggestion automatically only where its rules are confident. A person at the firm reviews the results, and approving a period is always a person’s act. Auditbench makes no decision about any individual that has legal or similarly significant effects.

• Account data is kept while you are a member of a firm on Auditbench. When a firm removes you, your access ends at once. Your name and email remain on the audit trail entries you made, because the trail is append-only and forms part of the firm’s working papers; they are deleted with the firm’s workspace.
• Client data is kept for as long as the firm keeps it on Auditbench. A firm can delete statements it has uploaded. When a firm leaves, it has 30 days to export its reports; we then delete its workspace — client data, statement files, audit trail and acceptance records — within a further 30 days.
• Enquiries and applications are kept for up to twelve months, unless they lead to an account.
• Error reports are kept by Sentry for the retention period of our plan with it.

We use the following providers (sub-processors) to run Auditbench. Each is bound by written data protection terms.

Before adding or replacing a provider that handles client data, we tell each firm’s administrators by email at least 30 days in advance and update this list.

Auditbench’s database and application run in Ireland, email is sent from Ireland and error reports are held in Germany, so personal data from Nigeria is transferred to the European Union. Statement files are stored by Cloudinary in the United States.

Under section 41 of the Nigeria Data Protection Act 2023, each of these transfers relies on contractual clauses that give the data an adequate level of protection: every provider is bound by written data protection terms, and for data leaving the European Economic Area — Cloudinary’s storage in the United States — those terms include the European Commission’s standard contractual clauses. We follow the Nigeria Data Protection Commission’s guidance on cross-border transfers (the General Application and Implementation Directive 2025, Schedule 5), and will tell you which mechanism covers a given provider on request.

• Data is encrypted in transit, and at rest by our database provider.
• Each firm’s records are separated in the database itself. Row-level security means one firm’s users cannot read or change another firm’s records, even by going around the application.
• Within a firm, what a person can do follows the capabilities of their role, checked by the application and again by the database.
• Statement files are stored privately and cannot be opened by a public link.
• Passwords must be at least 12 characters and are stored only as a hash.
• Every change to a firm’s records is written to an append-only audit trail.
• Named Zenaclove staff with platform administration rights can read firm records to operate and support the service. They cannot change them.

Auditbench sets only cookies that are strictly necessary for the service: session cookies that keep you signed in, and during a password reset, a short-lived cookie that marks the reset as verified. There are no analytics, advertising or tracking cookies and no third-party cookies, which is why you are not asked to accept any.

Under the NDPA and the GDPR you may ask for a copy of your personal data, have it corrected or deleted, restrict or object to how it is used, receive it in a portable form, and withdraw any consent you have given. Some of these rights are limited where the law requires a record to be kept.

• Account data. Write to support@auditbench.app from the address on your account. We reply within one month and may need to confirm your identity first. Where a request touches your firm’s records, such as your membership, we work it through with the firm.
• If you are named in a firm’s client records, the firm is responsible for them, and you should contact the firm. If you write to us instead, we pass your request to the firm concerned and help it respond; we do not act on client data without the firm’s instruction.

You may also complain to the Nigeria Data Protection Commission or, in the European Union, to the supervisory authority where you live or work. We would ask you to write to us first, so that we can put it right.

When this notice changes, the new text is published here under a new version date. If a change affects how client data is processed, firms are told by email before it takes effect.