Prove it
Temporary access for external auditors
Let an auditor, a large customer or a due diligence team review your AI governance without lending them credentials.
What it is for
When an external auditor, a large customer or a due diligence process wants to check how you govern AI, there is no need to add them to your team or lend them credentials: the Owner generates a temporary, read-only link.
The external auditor is not a member of your organisation and has no user account in Alethexis. They get in with a link the Owner generates and a code sent to their email — both are required — and consult your governance in read-only mode.
It is part of M2 and M3. If the reviewer belongs to your organisation, the Auditor role gives them that read-only access as a team member.
How it works
The Owner generates the link
They enter the auditor's email, the reason, the duration — 7, 30 or 90 days — and whether downloads are allowed. The link is shown only once: for security it is not stored and you will not be able to see it again. You can have up to 5 active accesses at a time.
Link plus a 6-digit code
The auditor opens the link and receives a 6-digit code by email, which expires in 15 minutes and works only once. Their session lasts at most 8 hours, and never beyond the link's expiry.
What they consult
In read-only mode, the system inventory, the classifications, the status of each section, the recorded decisions, the evidence index, the audit log and the status report. The portal has no screen from which anything can be changed.
A minimised view
Decisions appear with their date and their hash, without the name or role of whoever took them: in a small organisation, role and date together point to one person. If the auditor needs to know who, they ask you.
Always expires, always logged
There is no “no expiry” option and no extension. With “Revoke” you cut it off at any time, and any session the auditor had open stops working as soon as they move to the next screen. Every creation and revocation, every sign-in, the views they consult and every download are recorded in your audit log, with the auditor's email.
What you get
A CSV of each view, with its hash
If the access allows downloads, the auditor can download each view as CSV. The file name carries the beginning of its SHA-256 hash, computed on the file as it is downloaded. The portal does not offer PDF downloads; if the access was granted for viewing only, there is no download.
FAQ
- Does the external auditor take up a place on my team?
- They are not a member of your organisation: they are not invited to the team and have no user account in Alethexis.
- Can the auditor see who took each decision?
- No. They see the date and the hash of each decision, but not the name or role of whoever took it.
- Can I extend the period or change the download permission?
- Not on the same access. Revoke that access and create another with the duration or permission you need.
- What if the link is lost?
- For security it is not stored and cannot be shown again. Revoke that access and create another.