Audit Rights
Audit rights are your contract right to check that a vendor keeps its data protection promises. In practice, many vendors offer a SOC 2 report or similar document first and allow on-site audits only under conditions.
What are audit rights?
Audit rights are your contract right to check that a vendor is keeping its promises about your data. In a data processing agreement (DPA), they cover what proof the vendor must give you and whether you can inspect it yourself.
The GDPR, the EU privacy law, requires them. Article 28(3)(h) says the vendor must give you the information needed to show compliance and allow "audits, including inspections" by you or an auditor you choose. The EDPB, the body of EU privacy regulators, says you should check the vendor's guarantees at appropriate intervals, through audits and inspections where appropriate.
What audit rights look like in practice
In practice, many vendors meet this duty with documents first. An on-site visit is the last step, with conditions. Here is what three DPAs we opened say, as of October 2026:
- Stripe: provides its SOC 1 and SOC 2 reports on request, produced annually. It answers a written security questionnaire no more than once a year.
- HubSpot: provides its SOC 2 report and summary penetration test reports, on a confidential basis. It allows inspections by you or your auditor where the law requires it.
- Atlassian: provides a summary of relevant audit reports under a non-disclosure agreement. An on-site audit is allowed only if those do not settle the question or a regulator requires it, at your expense, with 60 days' written notice and no more than once every 12 months.
A SOC 2 report is an independent auditor's report on a vendor's security controls. It is useful, but it covers only what is in its scope.
A real change we caught
Venpo flagged that Insightly's new AI connector is not covered by its SOC 2 report. If your audit rights rely on that report, the new feature sits outside what you can verify.
Why it matters to you
Audit rights are how you show your own customers and regulators that you checked your vendors. A report request is often the only audit a small team will ever run.
The limits matter when something goes wrong. After a breach, you may want more than a yearly report. Notice periods, cost rules and once-a-year caps can slow you down.
What to check
- Find what documents the vendor will provide: SOC 2, ISO 27001 certificate, penetration test summary.
- Check the conditions for an on-site audit: notice, cost, frequency.
- Check whether a breach or a regulator's request allows an extra audit.
- Read the SOC 2 scope and confirm it covers the product and features you use.
- Check whether audit rights flow down to the vendor's subprocessors.
How Venpo helps
Venpo monitors your vendors' DPAs and trust center pages and emails you a plain-English alert when audit terms or listed reports change. Each vendor's change history shows what the terms said before.
Frequently asked questions
Can I audit my SaaS vendor on site?
Sometimes, but many DPAs set conditions first. Atlassian's, for example, allows it only if its reports do not answer your questions, with 60 days' notice and at your cost.
Is a SOC 2 report enough for GDPR audit rights?
It is a common way to show compliance, but the GDPR also gives you the right to audits, including inspections. A report only covers what its scope includes.
Related terms
Sources
Last reviewed