Loading AuditFlow…
Field-first internal audit
AuditFlow captures inspections where the work happens — offline, with time-stamped photo evidence, a record of where each audit was submitted and a tamper-evident trail — then turns findings into tracked corrective actions. So when the BRCGS auditor, the ISO 45001 certification body or an OSHA compliance officer arrives, you open a report instead of a week of reconstruction.
Lockout / Tagout (LOTO) verification · question 7 of 15 · Safety Officer / Maintenance Lead
Zero-energy verification (try-step) is performed before work starts
The single most skipped step
OSHA OSHA.1910.147
The score is 90.91% and the audit still failed, because a critical question failed: Zero-energy verification (try-step) is performed before work starts. A percentage is not a verdict, and your auditor knows that before they leave the site.
The actual problem
They fail because the evidence was never captured in a form anyone else can verify. These are the three ways it goes wrong.
A photo in a WhatsApp group has no timestamp an assessor will accept, no location, and no link to the question it answers. When someone asks 'when was this taken and where', the honest answer is nobody knows.
What AuditFlow does
Every photo is captured in-app, stamped with device time and tied to the specific question it evidences. Every audit records where it was submitted; individual photos carry a location too on questions whose template asks for one (Growth and above).
The audit gets done. Fifteen findings get written down. Four get fixed. Nobody notices the other eleven until the same ones appear in next quarter's audit, and the quarter after that.
What AuditFlow does
Findings become action items with an owner, a due date and an escalation path. The failure heatmap shows you exactly which questions keep failing across sites.
The work was done. The evidence exists — scattered across email, a shared drive, three phones and a filing cabinet. Assembling it costs a week of a senior person's time, every single time.
What AuditFlow does
Evidence is filed against the framework control it satisfies as it is captured. The gap analysis tells you what is missing while there is still time to fix it.
How it works
No training course and no implementation project. Pick a checklist, walk the site, hand over the report.
Pick a template that already knows your standard
Choose from 218 templates covering 15 industries — each one already carrying weighted questions, auditor guidance and clause references. Or build your own.
Run the audit where the work happens
On a phone, offline if needed. Capture photos, with a location fix on the questions your template asks for one. Dictate notes by voice. The app scores as you go so you know the result before you leave the floor.
Findings become work, not paperwork
Failed questions convert to action items with owners and due dates. Overdue items escalate. Repeat failures surface on the heatmap.
Hand the assessor a report, not a shoebox
Download the audit report as a PDF — findings, evidence, the working papers and the sampling basis behind them — share an expiring, revocable read-only portal with an external auditor, or export the evidence pack for the control they asked about. Sign-off records who signed, in what role, in the tamper-evident trail.
AI
Every AI control here drafts, explains or describes. None of them decides. No model sets whether an audit passed, writes an auditor's answer or raises a finding — the scoring engine does the first, a qualified person does the other two. The name on the report is your auditor's, and an inspector holds them to it, not us.
The hardest part of adopting any audit tool is the blank template. Say what your business does and what you want checked, and you get a drafted questionnaire — wording, answer types and auditor guidance — open in an editor. Change any question, delete any question, then save. Nothing exists until you save it.
About five seconds, and it costs no credits — it is the first thing you do on day one.
Ask who has overdue items, which site keeps failing the same check, or what is due before the next inspection — and get an answer from your own audits, findings and deadlines. It reads with your permissions, so a member restricted to one site gets answers about that site and nothing else.
Counts are exact and a list says what it left out. If it cannot read the workspace it tells you it is answering generally, rather than inventing a workspace that sounds right.
Draft a corrective action from a finding. Explain why a score came out where it did. Describe what is in an evidence photo. Propose questions for a control you have no coverage on. Clean up a note dictated while walking a line.
The photo analyser describes what it sees and does not rate the risk — a model's guess at a risk level from one photograph would be a made-up assessment sitting in a compliance file.
Every AI control prints its own price, read from one list rather than typed beside the button. Some cost nothing because no model is called at all — "Prefill from past audits" is the statistical mode of your own previous answers to the same question, which is a database read. When a model call fails, the credits go back.
Features
Capture it on the floor, close it out, and hand somebody the proof. Nothing here is on a roadmap.
Capabilities differ by plan — the pricing table below says which plan carries what.
Industries
Every industry below ships with real templates carrying weighted questions, auditor guidance and clause references. Not category placeholders.
The figure against each industry is how many templates ship for it today.
Framework coverage
Evidence platforms built for SaaS security assume your evidence is an API call away. Ours assumes it is a photograph of a damaged rack upright, taken in a warehouse with no signal.
Each framework has a real control library in the product, and template questions map to specific clauses within it.
IN — India-specific framework
Pricing
Seasonal auditors and contractors shouldn't change your bill. Every plan captures audits offline with photo evidence, and the storage allowance below covers everything you keep — photos, documents and attachments alike. Need more room? Extra storage can be added to any plan.
Shown for comparison. Billing is in INR and needs an Indian billing state for the GST invoice — talk to us if you are outside India.
The whole product, one site, real money
Anyone who wants to run their own audit before committing to a tier — and keep the workspace either way.
Paid plan · billing straight after signup
One site, one team, done properly
A single facility running recurring checks — one plant, one clinic, one restaurant group.
Paid plan · billing straight after signup
Most chosen
Multi-site, with the analytics to run it
Compliance teams covering several sites who need to see where failures repeat.
Paid plan · billing straight after signup
For programmes an external auditor will inspect
Regulated organisations who must hand evidence to a certification body or regulator.
Paid plan · billing straight after signup
Procurement, security review, the whole thing
Organisations with an SSO mandate, a procurement process or a security questionnaire.
| Limits | Essentials | Starter | Growth | Scale | Enterprise |
|---|---|---|---|---|---|
| Sites | 1 | 1 | 10 | Unlimited | Unlimited |
| Team members | 3 | 10 | Unlimited | Unlimited | Unlimited |
| Templates | 3 | 10 | All 218 + custom | All 218 + custom | All 218 + custom |
| Audits / month | 20 | 100 | Unlimited | Unlimited | Unlimited |
| Evidence storage | 5 GB | 25 GB | 150 GB | 750 GB | 2000 GB |
| AI credits / month | 80 | 400 | 1,200 | 3,000 | 10,000 |
| Photo evidence | Included | Included | Included | Included | Included |
| GPS-stamped photos | — | — | Included | Included | Included |
| Pass conditions & critical questions | — | — | Included | Included | Included |
| Bulk import (CSV / Excel) | — | Included | Included | Included | Included |
| Conditional questions & clause mapping | — | — | — | Included | Included |
Every plan is paid from the day you sign up — there is no free trial. Essentials starts at $12/mo for the whole product on one site, so you can run a real audit before deciding whether you need Growth or Scale. Cancel anytime; your workspace becomes read-only rather than being deleted, and you can export everything at any point.
Walkthrough
Send us the checklist you use today. We will build it into AuditFlow and walk you through running it — so you are evaluating your actual audit, not a generic demo.
Security
Our customers assess suppliers for a living, so they ask harder questions than most. These are the answers, and the controls behind them are built against the standards you already work to.
Row-level security on every table, keyed to your organisation. A query cannot return another tenant's rows even if application code asks it to — the guarantee sits below the app, not inside it.
Sign-offs, approvals, score overrides, report shares, role changes and permission changes are appended to a per-organisation SHA-256 hash chain, each entry committing to the one before it. Any member can have the server recompute the whole chain: an entry edited or removed after the fact does not verify. The database revokes UPDATE and DELETE on the trail and refuses them again in a trigger. The broader activity feed is not chained, and is deleted on the retention schedule you set. Photos carry capture time, and a location on questions whose template asks for one.
Three roles, plus a permission matrix that revokes capabilities from Auditor and Viewer at the point the action is performed rather than only in the interface — it can narrow a role, never widen one. Configurable session timeouts, enforced MFA and IP allowlisting. SSO / SAML is not switched on: Enterprise records your IdP details and we scope the work with you, and every account signs in with a password today. External auditors get expiring, revocable, logged read-only access to the whole workspace's finished audits.
Set how long audits, activity logs and notifications are kept, with a notice period before the first deletion and a permanent hold on signed-off audits. Data is held in India — Supabase, AWS ap-south-1. Export everything at any time; deletion happens when you ask for it, not on our schedule.
FAQ
An afternoon for a single site. Create your workspace, pick templates matching your industry, invite your team, and run your first audit the same day. There is no mandatory onboarding call and no implementation fee.
Yes — including starting one. Answers, notes and photos are written to local device storage as you work and sync automatically when connectivity returns; the photos upload before the submission, so nothing arrives after the report, and a submission that gets sent twice still lands once. Open the app while you still have signal so the template is on the device, then walk the site with none. This is the main reason teams pick us over browser-only tools — cold stores, plant rooms and remote sites rarely have reliable signal.
Yes. Build from scratch in the template builder on any plan — your own questions and sections, the answer type, whether an answer is required, and the weight each question carries. Pass/fail conditions and marking a question critical come with Growth; conditional questions, clause mappings and a custom grade ladder come with Scale. Importing a CSV or Excel workbook is Starter and above. Most teams start from a library template and edit it.
No, and it cannot. Pass or fail is computed by the scoring engine from the answers your auditor gave and the rules on the template — the same function everywhere the result is shown, so a report cannot disagree with the screen it came from. AI drafts templates, suggests corrective actions, explains a score and describes what is in a photo. None of that can set a verdict, fill in an answer or raise a finding, and sign-offs and approvals go into a hash chain that records who accepted what. Where AI does write something — an audit summary, a narrative for a board pack — it is stored as AI-generated prose, labelled as such, and it never changes a score. The evidence-photo analyser deliberately does not rate risk: a model's guess from one photograph does not belong in a compliance file.
Every plan, including the entry tier, carries a monthly allowance of AI credits — 80 a month at the entry price, more on each tier above, and top-up packs if you run out. Each control prints its own cost before you press it: most are 1 to 4 credits, and a few cost nothing because no model is called. Drafting a template from a description is not charged at all. If a model call fails, the credits are returned.
Your workspace becomes read-only rather than being deleted. You can export everything — audits, evidence, action items and reports — at any time, including after downgrade. Full deletion happens only when you explicitly request it.
A DPA, our subprocessor list, a security practices summary and a completed copy of your own security questionnaire. Our controls are built against the ISO 27001 Annex A control set, SOC 2 Trust Services Criteria and the DPDPA 2023 obligations for Indian data fiduciaries — the same standards you are auditing your suppliers against. Talk to us about our current certification roadmap and we will answer directly.
Every table enforces row-level security keyed to your organisation, so a query can only ever return your rows — isolation is enforced by the database itself rather than by application code remembering to filter. Evidence files are scoped the same way. Data is encrypted in transit and at rest.
Yes — a read-only link you can expire or revoke, with access logged. It is the whole workspace's completed audits and findings, read-only: there is no per-site or per-framework narrowing yet, so share it when you are content for the auditor to see everything finished. You can also publish a public compliance scorecard if you want to show customers your status.
Yes. Sites are first-class from the Growth plan up, with cross-site comparison, per-site scoring and consolidated reporting. Multi-org rollups are available for groups managing separate legal entities.
Growth and above include unlimited team members, so seasonal auditors or contractors do not change your bill. Pricing is by sites and capability tier, not per seat.
Pick a template, walk the floor with your phone, and see the finished report before you get back to your desk. That is the whole evaluation.