Audit management with a real login for your auditor.

Invite an external auditor to their own read-only portal: verified with a one-time code sent to their email, limited to 1-60 days and revocable at any moment. They read every register, comment on controls and add notes to incidents. Prepare for Audit scores your readiness before they arrive, and the PDF audit trail hands over the evidence.

Start free See pricing

Describes the product as of 1 October 2026. The Subscription screen in the portal is authoritative for plan placement.

At a glance

Auditor login (Pro+): personal invitation link plus a one-time email code, 1-60 days, revocable, every step in the activity log.
What they see: frameworks, controls with evidence and history, risks, incidents, sub-processors, policies, records of processing, Statement of Applicability, documents and activity.
Collaboration: auditors comment on controls and add notes to incident timelines.
Prepare for Audit: 34 workspace checks plus checks per framework, with a live score. Enterprise.
Hand-over: PDF audit trail (white-label on Enterprise), SoA, RoPA and DPIA PDFs, Excel/CSV of every register.

On this page

The auditor login
What auditors see
Comments, notes and follow-up
Prepare for Audit and the readiness score
The PDF audit trail and other hand-over files
Evidence integrity and the activity log

Auditors do not share a member account and do not get a static password. An admin invites them by name and email and picks how long the access lasts: from 1 to 60 days, 30 by default.

Two factors by design: the invitation email contains a personal link, and opening it is not enough. The auditor requests a 6-digit code that is sent to the invited address, and only that code opens a signed auditor session.
Abuse limits: at most 5 code requests an hour, 5 attempts per code and 10 failed attempts an hour.
Time-limited: access ends on the chosen date. A session never outlives the access period.
Revocable: revoke an auditor and their session stops working on the next request. Regenerating a link invalidates the old one and keeps the same end date.
Stored as hashes: invitation links are shown once and kept only as a hash.
Logged: invitations, verifications, revocations and regenerated links appear in the activity log as auditor.invited, auditor.verified, auditor.revoked and auditor.link-regenerated.
The admin overview lists every auditor with name, email, who invited them, end date and whether the access is active, expired or revoked.

What auditors see

The auditor portal at compliance.dazr.eu/auditor opens on a framework overview with completion per framework, followed by these tabs:

Tab	Contents
Controls	Every control with description, recommendation, evidence (notes, links and files), comments and the full history; filter by framework and status
Risks	The risk register with inherent and residual scores, treatment and acceptance
Incidents	The incident register with timeline, notification fields and clocks
Sub-processors	The vendor register
Policies	Policies and their versions
Processing	GDPR records of processing and DPIAs, with RoPA and DPIA PDF downloads
Statement of Applicability	Applicability and justification per control, with PDF download
Documents	The documents linked in the compliance profile
Activity	The activity log since the auditor's access began, without free-text details

Evidence files download through an authenticated proxy, never through a raw storage link. Everything is read-only: any attempt to change data is refused.

Comments, notes and follow-up

Auditor comments on any control, labelled as auditor comments in the control's thread, next to comments from your own team.
Auditor notes on incidents, added to the incident timeline as their own entry type.
Follow-up runs on tasks: turn each observation into a custom task with an owner and due date (from Basic). The due-soon and overdue reminders then chase it like any control, and ISO 22301 and ISO 27001 include their own nonconformity and corrective-action controls.
Corrective actions from incidents: an incident can link the corrective-action task it produced, so the lesson learned closes in a tracked task.

Dazr does not have a separate findings register with its own workflow; findings live as comments and tasks.

Prepare for Audit and the readiness score

Prepare for Audit runs the questions an auditor asks in the first days of an engagement against your live workspace. Each check is pass, warn, fail or not applicable, with the detail behind it and a link or an inline field to fix it.

Section	Checks	Examples
Workspace identity	6	Organisation name, country, address, VAT number, security lead, DPO contact
Core policy library	11	Information security, acceptable use, access control, cryptography, incident runbook, BC/DR plan, asset inventory, supplier register, network diagram
Operating evidence	17	Control owners, nothing overdue more than 90 days, risk register populated, critical risks mitigated, management review, internal audit, awareness training, phishing test, BC/DR test, backup-restore test, pen test, vulnerability scan, access review
Per framework	2 + specific	All controls owned, controls reviewed in the last 12 months, plus framework checks such as the ISO 22301 BIA and exercise programme

The score is (passed + 0.5 × warned) / applicable checks, shown as a dashboard card and recorded in the trend. Prepare for Audit is included in Enterprise; on other plans a preview shows how many gaps there are, with the first two in full.

The PDF audit trail and other hand-over files

PDF audit trail: cover, summary with total, completed, open and overdue controls, completion per framework, outstanding items, a section per framework grouped by theme, the completion log and a sign-off page. Dazr-branded on Basic, with your company name on Pro, fully white-label on Enterprise: your logo, subtitle, footer text and signing officer.
Statement of Applicability as PDF or XLSX, including approved versions.
GDPR: Art. 30 records of processing and DPIA reports as PDF.
Excel and CSV of vendors, assets, incidents, risks, processing activities, DPIAs, controls, members, the activity log, policies, trust-page answers and the SoA (from Basic).

Evidence integrity and the activity log

Once a control is completed, its evidence note and link are locked. Only the validity date can still change.
Every state-changing action lands in the activity log with who and when, including actions taken by Dazr support. Search, filter by type and date, and export it.
The log keeps the most recent 2,000 events on Free, 5,000 on Basic, 25,000 on Pro and 50,000 on Enterprise.

Audit management questions, answered.

Does Dazr have an auditor login?

Yes. External auditors get their own read-only portal at compliance.dazr.eu/auditor. They open a personal invitation link and verify with a one-time 6-digit code sent to their email. Access lasts 1 to 60 days and can be revoked at any time. Included in Pro and Enterprise.

What can an auditor see and do?

They read the framework overview, controls with evidence, comments and history, the risk register, incidents, sub-processors, policies, records of processing and DPIAs, the Statement of Applicability, linked documents and the activity log since their access began. They can comment on controls and add notes to incidents, and download evidence files and the SoA, RoPA and DPIA PDFs. They cannot change anything else.

Can auditors comment on controls?

Yes. Auditor comments appear in the control's thread, labelled as coming from the auditor. Auditors can also add notes to an incident timeline.

Does Dazr track audit findings?

Findings are followed up as tasks: each one becomes a custom task with an owner and a due date, which the reminders and overdue emails then chase. Incidents can link their corrective-action task. There is no separate findings register with its own workflow.

What is in the PDF audit trail?

A cover, a summary with control totals, completion per framework, outstanding items, a section per framework grouped by theme, the completion log and a sign-off page. It is Dazr-branded on Basic, carries your company name on Pro and is white-label on Enterprise.

Will my external auditor accept this?

Dazr gives auditors what they typically ask for: a timestamped activity log with the responsible person, evidence attached to each control, time-limited read-only auditor access and exports (PDF audit trail, Excel and CSV). Whether that evidence is sufficient is always the auditor's call.

What is in Prepare for Audit?

A live audit-readiness score per framework, also shown as a card on the dashboard. Each item is a question an auditor is likely to ask, such as the Statement of Applicability, the last management review or the last ASV scan, and inline edits save the answers as you go. Prepare for Audit is included in Enterprise.

Give your auditor a login

Auditor access is included from Pro, €99 a month; Prepare for Audit and the white-label PDF on Enterprise, €499 a month. Excl. VAT, cancel any time.