Where your data lives and who can see it

1. Where your data is stored

The website and the subscriber area run on Hostinger web hosting in the EU. Data updates, monthly reports and backups are processed on our own virtual server, rented from Hostinger in a data centre in Vilnius, Lithuania (EU). All pages and the subscriber area are served over encrypted connections (HTTPS).

2. What we store

Two kinds of data. First, the list itself: company-level data from public Form 5500 filings of the U.S. Department of Labor. Second, what your team enters: statuses, notes, follow-up dates, assignments, the activity history, saved views, and the names and business e-mail addresses of your team members. For your account we also keep your firm, business e-mail, package and the dates and payment references of your subscription.

3. Who can see your work data

Only your team. Your statuses and notes are stored per subscription and shown only to the people with access to that subscription. Other audit firms using First Audit Radar never see them, and we never tell a plan sponsor, recordkeeper or another firm which firms use the list (a quotation on our website appears only if you choose to give one). For this data we act as your processor under Art. 28 GDPR, on the basis of section 8 of our terms, and use it for no other purpose.

4. Signing in

There are no passwords, so we store none. You sign in with a personal access link that we e-mail to you. Each team member gets their own link. When the subscription owner removes a member, that member's link stops working at once. If you lose your link, the Log in page sends it again, only to the e-mail address on file for that access.

5. Backups

A daily backup of customer, team and work-list data is kept on our server for 30 days. Once a week an encrypted copy of the same data (AES-256; the key is held only by us) is sent to the operator's own Google mailbox and deleted there after 30 days. Without the key the copy cannot be read.

6. When data is deleted

• Work data: when a subscription or Founding Firm pilot ends without a refund, your account continues as the free basic plan and your work list stays. 30 days after the basic plan ends, or 30 days after a refund or termination, your work data and all team members are deleted automatically, also from the backups on our server. You can export your list at any time before.
• Reservations: kept for up to 12 months, or until they become a subscription.
• Founding Firm applications that do not lead to a pilot: deleted after 12 months.
• Account and billing record: kept for 7 years, as Austrian accounting law requires, without your work data.

7. Cookies and tracking

This website uses no cookies and no third-party tracking. We count page views and clicks with our own small script on our own hosting. The IP address is not stored; the visitor ID is a one-way hash that changes every day. Links in our e-mails and printed letters to audit firms can carry an opaque firm identifier (?f=…, also in the short address /k/…), a random code that contains no name. It lets us see which firm we wrote to opened the page, the sample or the demo, or applied, so that we do not write to firms that already applied and can measure which e-mail works. It is stored with the same visit statistics and with a Founding Firm application. Visits without such a code are counted only under the daily changing visitor ID. If you arrive through a link with campaign parameters, they are kept in your browser's session storage for that tab only and are gone when you close it. In the subscriber area your browser remembers in local storage whether you have seen the product tour. The map in the subscriber area loads map images from OpenStreetMap, which receives the viewer's IP address.

8. We do not sell data

We do not sell or pass on your work data, and we do not sell plan data to plan sponsors or recordkeepers. Your entries are used only to run the service for your firm. First Audit Radar is independent and not affiliated with the Department of Labor, the AICPA or any audit firm.

9. No personal data in the lists

The lists contain company-level information: plan sponsor, EIN, plan name and number, location, industry, participant counts, financial figures, filing dates, the company's business address and company phone as filed, and the firms that serve the plan. Names of signers, preparers and other individuals are removed. Sponsors whose name is a person's name are shown without street address or phone. Any company can ask to be removed from our public pages and samples through our contact form.

10. Payment

Card details never reach us. Online checkout is not open yet: today you reserve a package with your firm name and business e-mail only, and nothing is charged. Once online checkout is live, Paddle.com acts as our merchant of record: it takes the payment and issues the invoice, including any sales tax.

11. Service providers and incidents

Sub-processors for your work data: Hostinger International Ltd. (web hosting, customer e-mail delivery, the virtual server in Lithuania) and Google (the encrypted weekly backup copy). We tell you by e-mail before we add or replace one, and you may object. If a personal data breach affects your data, we inform you without undue delay.

Questions about security or data handling: our contact form. First Audit Radar is run by Christoph (Chris) Ploner, near Vienna, Austria; full address in the imprint.