Agreely
FR EN

Auditor access

An external auditor, outside counsel or a regulator does not need a seat in your workspace to review your programme. The owner mints a time-boxed, revocable review link; the person opens it with no account and lands on a read-only portal over your organization.

It is an accountability surface (P-39.1 art. 3.1; A-2.1 art. 52.2), not an administration surface: nothing there is editable.

The screen lives under the compliance hub. Each link carries:

  • a label (the firm or person you hand it to), so the list stays readable and a revocation targets the right link;
  • an expiry, from 1 to 90 days, 14 days by default. Past that, the link simply stops working.

At most five active links coexist per company. The plaintext link appears exactly once, at creation: it is never stored, only its fingerprint is. If you lose it, revoke it and mint another. Revocation takes effect immediately.

Writes (mint, revoke) are restricted to the owner and admin, as for API keys.

What the auditor sees

The portal renders your registers, each read-only:
Governance The privacy officer, the published policies and their version history
Programme The catalog and its legal-basis map, the published consent documents with their IPFS copy and integrity
Registers Retention, security, anonymization, communications outside Quebec and their PIAs, privacy incidents, rights requests, destruction obligations, processors and mandataries, project PIAs
Minors The art. 4.1 handling
Integrity The verification state of the access log and the on-chain trail
Customers The per-subject register, by your own customer reference

Two registers appear only for a public body (the access and protection committee, and the art. 67.3 register), and one register appears only for a private enterprise (secondary uses). So an auditor never sees a surface that belongs to the other regime.

The portal never shows a data subject's name or email

Fields identifying a data subject are omitted entirely from the auditor view, not masked: a subject is designated there by your own customer reference. Governance contacts (the privacy officer, the committee members) show normally, because those are precisely the people the Act asks you to name.

The downloads

The portal offers three artifacts, all re-verifiable elsewhere:

  • The accountability dossier (dossier.zip). The single, section-labelled evidence file describing how the whole programme is configured: the governance foundations, the catalog and its legal-basis map, the published disclosures with their integrity, the retention and destruction registers, the access log's integrity posture, the incident register, the cross-border assessment, the minors handling and the rights-request register with its 30-day clock. It opens on an article-by-article coverage index whose every status reflects the real configured state. The ZIP contains a machine-readable dossier.json, a self-contained printable index.html, a copy of the access-log.csv register and the verification manifest.
  • The verification manifest (verification-manifest.json). The set of reconstructed verification bundles, to drop into the batch verifier at app.agreely.ca/verify/batch and check a whole dossier's worth of consents in one shot, in your own browser: no bundle is ever uploaded.
  • The access log (access-log.csv), the tamper-evident register itself. See The access log.

A signed bundle carries the citizen DID, and is withheld when it names a guardian

A verification bundle reproduces a signed receipt byte for byte. Whatever the receipt contains therefore travels with it, including the citizen's DID inside the signature: it cannot be redacted without destroying the only thing the artifact is for. The auditor copy therefore withholds whole bundles rather than editing them, and the manifest says so (the withheld count is in the envelope). The rule enforced today: any bundle that would name a minor's guardian (art. 4.1) is withheld.

A consent erased by crypto-shredding has no bundle left to hand over. The manifest says so rather than omitting it silently.

What this portal is not

An accountability dossier is not an attestation of compliance

The dossier is an accountability aid. It gathers and presents what you have configured, and it documents what is cryptographically verifiable. It gives no legal advice and certifies no compliance; the final validation rests with your organization and its privacy counsel.

Next