Audit firms that know ThirdSentry inside out.
AUDITOR role is enforced at the data layer, not a permissions toggle. Your auditor gets a read-only workspace with exactly what you've published, and nothing more. Built for SOC 2, ISO 27001, HIPAA, and beyond.
Audit-grade by architecture.
AUDITOR role at the data layer
Read-only enforced in the database, not the UI. Auditor cannot edit a record, accidentally or otherwise. Built-in commenting and review-submission lets them work without write access.
- Read-only enforced in DB layer
- Comment + review submission only
- Per-framework workspace views
Immutable PolicyVersion records
When a policy publishes, a PolicyVersion record locks. Your auditor sees what was published, when, and by whom. Drafts and edits stay separate. No 'wait, which version was approved?' moment.
- PolicyVersion locked on publish
- Full activity log on every change
- Drafts isolated from approved artifacts
Partner with us
If you're an audit firm running SOC 2, ISO 27001, HIPAA, or PCI engagements for your clients, we'd like to talk. Co-marketing, training, and direct technical support included.
- Co-marketing opportunities
- Direct technical support line
- Free practitioner training
Frequently asked questions
What can an auditor do in ThirdSentry, and what is blocked?
The AUDITOR role can read assessments, risks, policies, and evidence, leave reviewer comments, and submit reviews. It cannot create, edit, or delete any record. The restriction is enforced on the server, not only in the interface, so the limit does not depend on which buttons an auditor can see.
How do we know a policy was not changed after it was approved?
A policy moves through draft, submit, approve, publish, and retire. An immutable PolicyVersion record is created only at publish, and it cannot be edited afterward. Later edits happen on a new draft and produce a new version when published. The auditor reads the published version together with the log of who approved it and when.
Is there an audit trail of changes made during the audit period?
Yes. Every change to a record is written to the audit log with the user and the time. Risks are never erased: a deleted risk is kept, flagged, and needs a recorded reason. Evidence becomes immutable once it is linked to an approved assessment or questionnaire response.
Which frameworks can audit firms work on in ThirdSentry?
Ten frameworks are built in, including SOC 2, ISO 27001:2022, PCI DSS v4.0.1, the HIPAA Security Rule, NIST SP 800-53 Rev 5, NIST CSF 2.0, and NYDFS 23 NYCRR Part 500. Controls are cross-mapped between frameworks. A verdict on one control carries to another only where the two are mapped as equivalent, never across partial overlaps.
Can the auditor review evidence in the platform instead of receiving exports?
Yes. Auditors read evidence where it lives, linked to the controls, assessments, and questionnaire responses it supports. They can comment on an item and submit a review without being given edit rights. Because pricing is flat fee with unlimited users, the client does not pay extra to give the audit team their own accounts.