Legal framework & compliance

Terms of use

Access to the platform implies acceptance of these terms. SAUDITER.BJ provides a tool to help prepare for compliance. It does not issue any certification and does not replace an accredited external auditor. The client organization remains solely responsible for its legal and regulatory compliance.

1. Description of the service

SAUDITER.BJ is a SaaS compliance readiness (GRC) platform: structuring of security controls, cross-mapping to several frameworks (ISO 27001, PCI DSS, APDP, GDPR, PSSIE, HIPAA, FSSNQ, NIST CSF, ISO 9001…), adaptive questionnaire, evidence vault, AI-assisted document drafting, PDF report and a review area for an external auditor.

2. Registration and account

Creating an account commits the client organization to provide accurate and up-to-date information. Each user is responsible for the confidentiality of their credentials and for the actions carried out from their account. Email two-factor authentication is disabled by default for all accounts and can be enabled from the account settings.

3. Plans and pricing

The platform offers a free Freemium plan (limited features and frameworks), an annual Pro plan and an Enterprise plan on quotation - full details and current prices on the Pricing page. Prices may change; any price change is communicated before it applies at the renewal of an ongoing subscription.

4. Payment and cancellation

Paid plans are paid by Mobile Money or card through our payment providers (Feexpay, Kkiapay); the plan is activated once the provider has confirmed the payment. A subscription can be cancelled from the Subscription area of the application or by request at sauditerbj@gmail.com.

5. User obligations

Users undertake to use the platform in accordance with the law and to ensure the accuracy of the data and documents they upload, and remain solely responsible for the content they upload. An active scan (ports, services, vulnerabilities) must only be launched on a scope your organization owns or is explicitly authorized to test. An unauthorized scan of a third party is abuse (SSRF) and makes you legally liable.

6. Intellectual property

The platform, its brand and its content (excluding the documents and evidence uploaded by the client, who remains their sole owner) are the property of SAUDITER.BJ or its licensors and may not be reproduced without authorization.

7. Availability and liability

SAUDITER.BJ uses reasonable means to ensure the availability and security of the service, without any guarantee of continuous availability outside a specific contractual commitment (Enterprise plan). The document templates provided do not constitute legal advice and must be reviewed by a lawyer.

8. Changes to the terms

These terms may be amended; users are informed in the application or by email. Continued use of the platform after notification constitutes acceptance of the amended terms.

9. Governing law and jurisdiction

How your data is processed is detailed in our privacy policy below.

Automated recommendations

To be validated before any action - does not constitute a compliance verdict. Each AI-assisted generation carries a visible marker and is traced (author of the validation, timestamp). No automated output is presented as a final compliance verdict.

Privacy policy

Data is isolated per organization, and uploaded files (evidence, reference documents) are encrypted at rest (AES-256-GCM) with a key dedicated to each organization. The platform keeps a record of processing activities compliant with APDP and GDPR requirements, and logs its access immutably.

1. Data controller

2. Data collected

Identification data (name, business email, password - stored hashed, never in clear text); professional data (organization, role); content uploaded by the client as part of its use (questionnaire answers, compliance evidence, drafted documents); technical connection data (IP address, user agent) for security purposes. Payment data (card number, Mobile Money) passes directly through our payment providers (Feexpay, Kkiapay) and is never stored by SAUDITER.BJ itself.

3. Purposes and legal bases

Provision and operation of the service (account, authentication, assessments, evidence, reports) - performance of the contract; account security and fraud prevention (audit log, alerts, two-factor authentication) - legitimate interest; billing and subscription management - performance of the contract and accounting obligations; responding to requests sent through the contact form - legitimate interest; AI-assisted drafting of documents and recommendations at the client's request - performance of the contract.

4. Recipients and processors

Data is never sold or used for advertising purposes. It may be passed on, strictly as necessary, to the following providers: hosting and secure storage of evidence (the platform's server infrastructure); sending of transactional emails (SMTP relay); payment processing (Feexpay, Kkiapay) for paid plans; and, only for the AI-assisted document and recommendation drafting features, an artificial intelligence provider (Groq and/or Anthropic depending on the active configuration), to which only the content strictly necessary for the requested generation is sent.

5. Transfers outside the WAEMU/EU

The AI providers mentioned above operate from the United States: using them may therefore involve a transfer of data outside the WAEMU/EU area, limited to the content strictly necessary for the requested generation (never a password or an authentication secret). See also Data sovereignty for the deployment options that limit this transfer.

6. Retention period

Account data is kept for the entire duration of the contractual relationship, then archived or deleted within a reasonable time after the account is closed, unless a longer retention period is required by law (accounting, fraud prevention). The immutable audit log is, by nature, kept indefinitely to guarantee the integrity of its history.

7. Security

Encryption at rest (AES-256-GCM) of uploaded files with a key dedicated to each organization, itself protected by a master key, hashed passwords (argon2), email two-factor authentication that can be enabled from the account settings, immutable audit log and strict isolation of data between organizations.

8. Cookies and trackers

SAUDITER.BJ uses no tracking cookies or third-party analytics tools (no Google Analytics or equivalent). The site only uses your browser's local storage (localStorage) to remember your display preferences (light/dark theme, language) and your login session: this data stays on your device, is never passed on to a third party, and is strictly necessary for the site to work - no consent banner is therefore required for these purely functional uses.

9. Your rights

In accordance with the GDPR and Beninese law no. 2017-20 on the protection of personal data, you have the right to access, rectify, erase, restrict, port and object to the processing of your data. You can exercise these rights by writing to sauditerbj@gmail.com; no data protection officer has been formally appointed yet, so these requests are handled directly by the SAUDITER.BJ team. You can also lodge a complaint with Benin's Personal Data Protection Authority (APDP), or with the competent supervisory authority if you reside in the European Union.

Data processing agreement (DPA)

Each client can sign a data processing agreement. It sets out the purposes, the categories of data, the security measures and the respective obligations of the controller and the processor.

Data sovereignty

Configurable sovereign hosting, strict isolation per organization, on-premises deployment option (self-contained Docker Compose) and pluggable local AI provider.