Audit Policy

4 min read

0:00 4:05

Doc Summary

Effective date: January 1, 2026

This Audit Policy explains how Customers may audit Accept Mission’s compliance with its obligations under the Data Processing Addendum (“DPA”) and applicable European data protection legislation. This policy is designed to support transparency without compromising security, confidentiality, or the rights of other customers.

1) General #

Customer may audit Accept Mission’s compliance with its obligations under the DPA:

Up to once per calendar year, and
On other occasions where required by applicable European data protection legislation, including where mandated by Customer’s competent supervisory authority.

Accept Mission will contribute to such audits by providing information and assistance reasonably necessary to conduct the audit, subject to this Audit Policy.

2) Audit formats #

Audits may be satisfied through one or more of the following, depending on scope and Risk:

Written responses to security or privacy questionnaires
Remote review of relevant policies and evidence
Review of independent third-party reports
A remote audit session with Accept Mission representatives
An on-site audit, only where strictly necessary and agreed in advance

Accept Mission will work with Customer to select the least intrusive method that still meets Customer’s regulatory requirements.

3) Independence of the auditor #

If Customer appoints a third-party auditor, Accept Mission may object if the auditor is, in Accept Mission’s reasonable opinion:

Not independent,
A competitor of Accept Mission, or
Otherwise manifestly unsuitable (for example due to conflict of interest, insufficient qualifications, or security Risk).

If Accept Mission objects, Customer will appoint another auditor or conduct the audit itself.

4) Audit request and planning #

4.1 Notice period #

To request an audit, Customer must submit a proposed audit plan at least eight (8) weeks before the proposed start date.

4.2 Audit plan requirements #

The proposed audit plan must include:

Proposed scope and controls to be assessed
Proposed audit method (questionnaire, remote, on-site)
Proposed start date and duration
People involved (Customer and any auditor)
Evidence requested (documents, interviews, screenshots, logs)
Any specific regulatory driver (for example supervisory authority request)

4.3 Confidentiality and NDA #

Any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (acceptance not to be unreasonably withheld). All information exchanged and any audit results must be treated as confidential.

Nothing in this policy requires Accept Mission to breach duties of confidentiality to other customers, employees, or vendors.

4.4 Review and agreement #

Accept Mission will review the proposed audit plan and respond with questions or concerns, including where a request could compromise:

Security controls
Privacy obligations
Employment or internal policy requirements
Confidentiality obligations
Availability or stability of the Service

The parties will work cooperatively to agree on a final audit plan.

4.5 Timing and conduct #

Audits must:

Be conducted during regular business hours,
Follow the agreed final audit plan,
Comply with Accept Mission safety and security requirements, and
Not unreasonably interfere with Accept Mission business operations.

5) Use of third-party reports in lieu of audit #

If the controls requested by Customer are addressed in a qualified third-party report (for example SOC, ISO, NIST, or similar) performed within the prior twelve (12) months, and Accept Mission confirms there are no known material changes to the audited controls, Customer agrees to accept that report in lieu of auditing those same controls.

This approach reduces duplication and helps keep the audit focused on any Customer-specific requirements not covered by existing independent assurance.

6) Audit findings and reports #

Customer will promptly notify Accept Mission of any non-compliance discovered during the audit.

Customer will provide Accept Mission with any audit report generated in connection with the audit, unless:

prohibited by applicable European data protection legislation, or
otherwise instructed by a supervisory authority.

Customer may use audit reports only for:

meeting Customer regulatory audit requirements, and
confirming compliance with the DPA.

Customer must not use audit materials or reports to benchmark, publish, or disclose Accept Mission security practices beyond those purposes.

7) Audit costs #

Audits are conducted at Customer’s expense.

Customer will:

Pay the fees of any auditor appointed by Customer, and
Reimburse Accept Mission for time spent supporting the audit at Accept Mission’s then-current professional services rates (available on request).

Customer is also responsible for any fees charged by third-party subprocessors if their involvement is required for the audit.

Nothing in this policy requires Accept Mission to provide more information about subprocessors than those subprocessors generally make available to their customers.