§ 01
Definition
Providers commission firms such as Deloitte, KPMG, PwC, Securitum or Cure53 to inspect servers, configurations and policies. Many are 'assurance engagements' under the ISAE 3000 standard, which ends with a report on whether the claims were met during a specific period.
§ 02
How it works
Auditors interview staff, review server setups and logging configuration, and sometimes inspect live servers without warning. The report states its scope and limits: which systems were checked, when, and what could not be verified.
§ 03
Why it matters
An audit is stronger evidence than a privacy policy, but it is a snapshot, not a guarantee. Read the scope and date, and prefer providers that repeat audits regularly.