Licensed, adapted, and deployed on the firm’s own stack.
AuditSenior is ITGC testing software that an audit firm licenses from Bonfleur, not a hosted service it subscribes to.
Nothing on this site is an offer and no prices appear; the notice is on the legal page.
What a firm licenses, and what stays with the firm
Licensed
- Software
- The application, with its control library, its automated tests and its database migrations.
- Customization
- Adapting the software to the firm's requirements and to the stack the firm runs.
- Deployment
- Deploying the adapted software onto that stack.
- Maintenance
- Maintenance of the licensed software, delivered as the license agreement sets out.
Stays with the firm
- Model selection
- Which model answers, and the change management around changing it. The software records the change and, on every result, which model was requested and which one answered.
- Operation
- Operating the deployed software, including incident response.
- Audit data
- The firm's audit data. The software sends none of it to Bonfleur.
- Providers
- The accounts with the providers its deployment uses, with their credentials and terms.
- Infrastructure
- The hosting and encryption configuration of the infrastructure the firm deploys on.
- Retention
- The firm's retention policy for its own records.
The reference build runs on the components listed under showcase components on the legal page. Adapting those components to the firm’s own stack is scoped against that stack, as part of customization.
What maintenance covers
Under the standard license agreement, maintenance covers:
- Security updates, each delivered as a release the firm applies, with an advisory stating what is affected and what an operator must do.
- A response, in order of severity, when the software cannot be used for audit work or when a control, gate or report cannot be relied on as it stands.
- Support for the current release and the one before it.
- New behaviour, a new control template or a change to the firm’s methodology as implemented is customization, scoped separately. Response times are set in the license agreement.
Continuity, source escrow and ownership
AuditSenior is built and maintained by its founder, so a firm’s continuity is designed to rest on what the firm holds. The firm runs the source it is delivered, and if the licensor is unavailable, the escrow deposit, released on the terms of the license agreement, gives the firm what it needs to go on running and maintaining the software for its own use, for as long as its license runs.
The source-escrow bundle carries the application source with its tests and database migrations, the CI definition, the deployment runbook and documentation, the synthetic fixtures, the lockfiles, and the rights notice and contribution terms. It is built only from a clean commit, which its manifest names, and a scope document classifies every top-level path of the repository as shipped or withheld. Who holds the deposit, and what releases it, are terms of the license agreement, written for the case where the licensor stops maintaining the software.
- RIGHTS
- Bonfleur s.r.o. is the rights holder of the software, including its control library and documentation. Third-party components remain under their own licenses.
- ACCESS
- Access to the source conveys no license. A license exists only under a separate written agreement, negotiated outside this site.
- ASSIGN
- Contributions are accepted only under a signed agreement assigning their intellectual property to Bonfleur s.r.o.
How the build is checked
- Checks
Checked in continuous integration
Continuous integration runs on every push to the main branch and every pull request into it; what it runs, and the method behind the build, are set out in the maintenance record.
- Dependencies
A high-severity advisory fails the CI run
The same run audits the application's production dependency tree at the high and critical levels. The lockfiles ship with the source.
- Services
A preflight for four hosted services
A script checks identity, object storage, the coordination store and model access with the credentials a deployment is configured with, and reports a service with no credentials as skipped, not passed.
- Deliverables
Delivered with the source
A deployment runbook, the security policy with its reporting route and the releases it covers, and the lockfiles that pin every dependency. Each release also ships a software bill of materials in the CycloneDX format, listing every third-party package with its version, integrity hash and license, separating what ships in the product from what is used only to build and test it, and saying so where a package declares no license.
How an evaluation proceeds
Read how the file is produced and what it records
The platform page describes the workflow and the file it produces; the assurance page, what that file records about what happened to it.
A demonstration account
By invitation: a firm’s evaluators are members of their own demonstration organization, a tenant isolated from every other, and each accepts the demonstration terms, recorded by version, before reaching the platform. It may be used only with synthetic data, made up and not taken or derived from any real client, person, organization or engagement, and never with client, personal or confidential information, under the demonstration-accounts clause of the privacy notice on the legal page. What it shows, other than what Bonfleur has made public, is Bonfleur’s confidential information, and access may be limited or withdrawn at any time.
A licensing conversation
About the firm's requirements and its stack; a license exists only as § 02 describes.
Customization, deployment and maintenance
As set out in § 01.
A licensing question?
Write with a question about what a firm licenses, source escrow or an evaluation.