DocRack / Website
Evaluate the controls alongside the workflow.
Start with the data your procedure uses and who needs access. Product deployment and contractual assurances need evidence for the environment being evaluated.
Contact the teamAccess, approval and history
Ask for the role and engagement-access matrix, negative access tests, maker-checker behaviour, override history and completed-Run protections. The illustrative website workflow does not demonstrate deployed tenant isolation.
Data location and processing
Confirm hosting and backup regions, encryption, AI providers and data flows, model-training terms, subprocessors, retention/deletion and incident contact. India residency, no-training guarantees, SSO, certifications and deployment options are not established by this website.
Website enquiries are separate.
The website code saves demo and support enquiries to Google Sheets and attempts an optional internal notification through Resend. Shared abuse controls are implemented with a local fallback. Optional analytics is disabled pending owner configuration and processing review; live delivery and hosting-log retention have not been verified.
Do not submit confidential audit evidence in either enquiry form. Product audit-evidence storage and the website's hosting configuration are separate matters.
Your next procedure
Start with the work you need to review.
Discuss the sources, rules and output your team needs. Please keep confidential audit evidence out of the enquiry form.