Passive capture
No form submission, authentication, purchasing, outbound email, or active journey execution in Surface Review.
Security and trust
Ask for less. Record the boundary. Keep evidence private.
AuditDeck is designed around passive public review, explicit authorization, product-scoped access, server validation, and evidence provenance.
Current status. This is a static product preview. Customer accounts, private artifact storage, repository connections, payments, and security certifications are not active.
Verified today
Engine-level boundaries.
The current local engine provides bounded public crawling and synthetic source-intake safeguards. These controls do not yet constitute a hosted customer security program.
Origin boundary
Same-origin crawling, robots handling, crawl delay, depth, rate, and page limits constrain discovery.
Synthetic source intake
Exact local authorization, immutable commit identity, path and size bounds, binary exclusion, and secret redaction are tested with fixtures.
Before customer data
Controls still required.
AuditDeck will not describe these capabilities as live until implementation and end-to-end verification are complete.
| Area | Required production state | Preview state |
|---|---|---|
| Identity | Tenant-scoped authentication and authorization | Not connected |
| Artifacts | Private, encrypted storage with scoped access | Not connected |
| Repositories | Read-only installation scoped to selected repositories | Synthetic fixtures only |
| Retention | Enforced deletion schedule and audit trail | Policy target only |
| Payments | Server-owned prices and signed webhook authority | Not connected |
Responsible use
Authorization is part of scope.
A requester must own the target or have permission to commission the review. AuditDeck is not intended for credential testing, exploitation, circumvention, denial of service, or scanning private systems.