IT Audit Factory · Evidence-first audit operationsFree · Professional · MSP
IT Audit FactoryIT AUDIT FACTORYAudit, Evidence & Compliance Operations
Archived guide — original release identity

This guide describes a previous release. Use the current 4.1.0 documentation for new installations.

Documentation

Secure Data Path and Client Data at Rest

Version-specific product changes and operational boundaries documented in the R63 release note carried by R68.

MSPR63
All documentation / MSP / R63

Secure Data Path and Client Data at Rest

With Secure Communication enabled, IT Audit Factory treats protection as an end-to-end condition:

  1. The assessor connects to the MSP Server through the selected HTTPS/TLS profile.
  2. Enhanced profiles retain request signing; High Assurance and DoD-Aligned retain their existing mutual-TLS rules.
  3. The MSP Server must connect to PostgreSQL through TLS. If DatabaseSslMode is Disable, all /api/clients and /api/dashboard access returns a clear service-unavailable result before client records are queried or changed.
  4. Server evidence, reports and packages retain authenticated vault encryption. Temporary upload and extraction paths require Windows EFS while a secure profile is active.
  5. The assessor workstation requires EFS for settings, client run folders, cached downloads/previews, crash logs and temporary upload packages. Failure is fatal before client data is loaded or collected.

Boundaries

The application cannot silently take ownership of files the user selected from another location, nor can it force an auditor's removable media to support EFS. Original source evidence and explicit exports are outside the managed workspace. Store them on a BitLocker-protected volume or use an encrypted auditor package with a separately delivered password.

PostgreSQL TLS prevents readable client records on the server-to-database network hop. PostgreSQL still processes structured fields as database values. Protect the PostgreSQL data and backup volumes with BitLocker and restrict database administrator access. R63 does not claim application-level field encryption for every PostgreSQL column.

Guided Audit Prep drafts

Guided Audit Prep keeps unfinished entries in a separate draft for the active client, certification program, and requirement. Menu navigation, client/program switching, application restart, and a failed server save can no longer silently discard those entries. A successful server save removes the local draft. When Secure Communication is enabled, the draft directory and each draft file must pass the Windows EFS protection check before navigation is allowed.

Guide basis

R68 package: Docs/R63-Secure-Data-Path-and-Client-At-Rest.md

Published as a website guide on 1 October 2026. Where a bundled reference is older, the version-specific guide and installed interface take precedence.

Email SupportBack to documentation