Find out what your website, apps, and vendors actually do with personal information, and whether it matches what your privacy policy promises. Independent privacy audits by CISA-certified auditors.
Get Your QuoteYour privacy policy is a promise. A privacy audit checks whether your systems, your website, and your vendors keep it.
Our Certified Information Systems Auditors compare what you say about personal information with what actually happens to it: what is collected, where it goes, who can see it, how long it is kept, and whether consent and disclosures hold up. You learn which privacy rules apply to you, where you fall short, and the controls that would reduce the risk of a breach, a regulator’s inquiry, or a lawsuit.
Privacy is not one regulation, and these are not interchangeable. Each is scoped, tested, and reported separately, against the text of the rule it answers to.
This is the distinction that most often gets scoped wrong. The Privacy Rule governs how PHI may be used and disclosed and is audited here. The Security Rule governs the safeguards around electronic PHI and is part of our compliance audit. The Security Risk Analysis is required by the Security Rule but performed as its own engagement, as part of our risk assessment. Buying one does not satisfy the other two, and a regulator asking for the risk analysis will not accept a Privacy Rule report in its place. Our HIPAA compliance audit page sets out all three side by side if you are working out which ones apply to you.
Third-party scripts can read what visitors do and type, and send it to companies they have never heard of. Under the California Invasion of Privacy Act, that has become the basis for a wave of wiretapping claims.
We test each script against your consent flow and your disclosures, and show you which ones send data before consent, or send more than you disclose.
Independent no-log verification for VPN providers to confirm your no-log claims with a trusted third-party audit.
Altius IT also provides third-party Privacy No-Log Audit services for VPN providers seeking to independently verify and publicly substantiate their no-log privacy policies. VPN users trust your privacy policy; our audit gives that trust a foundation. Our CISA-certified auditors evaluate your VPN infrastructure to determine whether your server configurations or log files, independently or in combination, could be used to identify a specific user or their activity over your service.
Altius IT's report identifies specific issues and provides recommendations and detailed instructions to mitigate or eliminate each issue. After delivery of our reports, Altius IT provides three months of free support to answer any questions you may have.
Show clients, partners, and regulators that an independent certified auditor has reviewed your privacy controls. As Certified Information Systems Auditors, we can issue an Auditor Opinion Letter documenting our opinion against the privacy requirements in scope.
Altius IT provides a certified auditor with each engagement:
Our proposal provides you with detailed information so you know exactly how we will help you:
Three phases that compare what you promise about personal information with what actually happens to it.
We identify which privacy rules apply to you, then map where personal information is collected, stored, shared, and deleted, including websites, apps, vendors, and internal systems. You receive a detailed proposal covering scope, pricing options, team CVs, and sample reports.
We review your privacy notice, consent flows, and contracts, test website scripts and data flows, and check how requests to access or delete data are handled, against the text of each rule in scope.
You receive risk-rated findings with steps to fix each one, mapped to the rules that apply to you. We walk your team through the results and provide three months of free post-audit support.
This audit is for organizations that collect personal information and need to show it is handled the way they say it is.
| Businesses With Consumer Websites | Sites with advertising pixels, session replay, or chat widgets, facing CIPA wiretapping exposure. |
| California Businesses | Organizations subject to the CCPA, as amended by the CPRA, including its cybersecurity audit requirement. See our CCPA/CPRA cybersecurity audit. |
| Healthcare & Business Associates | Uses and disclosures of PHI under the HIPAA Privacy and Breach Notification Rules. |
| Processors of EU Personal Data | Organizations that process data for EU customers under GDPR Article 28 and Article 32. |
| VPN Providers | Services that want independent verification of their no-log claims. |
A security audit asks whether personal information is protected from unauthorized access. A privacy audit asks whether it is collected, used, shared, and kept the way your privacy notice and the law say it should be. Many organizations need both.
Yes. Advertising pixels, session replay, and chat widgets can send what visitors do and type to third parties, and plaintiffs have brought wiretapping claims under the California Invasion of Privacy Act on that basis. Our CIPA website tracking audit tests each script against your consent flow and disclosures.
No. The CCPA cybersecurity audit is a separate, independent audit of the security controls protecting personal information. Broader CCPA compliance work, such as notices and consumer requests, is part of the privacy audit. See our CCPA/CPRA cybersecurity audit.
It provides independent evidence that a VPN provider’s server configurations and log files, alone or in combination, could not be used to identify a specific user or their activity. On a clean finding, we issue a publishable Auditor Opinion Letter and a detailed report.
Unlike a security consultant, Altius IT is certified as a Certified Information Systems Auditor to perform a security audit of your environment and issue reports and recommendations to secure your systems. Altius IT has been featured in 40+ publications and nationwide media outlets.
Strengthen your applications and network infrastructure against evolving threats.
Meet HIPAA, GDPR, NIST, ISO, PCI-DSS, SOX, and other compliance standards.
Safeguard sensitive data, intellectual property, and customer information.
Every engagement includes follow-up support to ensure vulnerabilities are properly mitigated.
