External auditors

An external auditor (the statutory auditor, a tax auditor, the audit firm of an investor) gets read access to the whole system for the length of the audit, and nothing more: they change nothing, approve nothing, and every request they make is recorded for the organization to see. The decision is ADR-0099; the controls are AA1 to AA6.

Inviting an auditor

Settings → Auditors (an administrator) invites a person by e-mail with the date their access ends. Over the API it is POST /v1/users with role: "auditor" and access_until:

curl "${H[@]}" -X POST "$ERP_URL/v1/users" -d '{
  "email": "pruefer@audit-firm.example", "name": "Lena Brunner",
  "role": "auditor", "access_until": "2027-03-31T23:59:59Z"}'

• The auditor role holds read and audit: every screen, report and statement, the audit files (FEC, GoBD, SAF-T, the evidence pack: audit files), the document archive export and the audit trail. Anything that changes the books or the master data answers 403.
• access_until is required for an auditor (422 access_until_missing), must be in the future (access_until_past) and at most two years ahead (access_until_too_far). Another person may get an end date too (a temporary accountant); their requests are then logged the same way.
• From that moment the person cannot sign in (403, "the access … has ended"), a session that is running stops at once, and a session started earlier never lasts beyond it.
• The administrator moves the date with PATCH /v1/users/{id} (access_until), or ends the access at once by disabling the person (status: "disabled"). Nobody sets an end to their own access (409 own_access_until). An auditor's access always has an end; removing it is refused.
• The auditor signs in like anyone else: with the Google account of the address, or with the address and a password whose link Google e-mails them.

Connecting the auditor's AI over MCP

An auditor may connect Claude, or their firm's own AI, to Stabiso over MCP: in Claude, Settings → Connectors → Add custom connector with https://app.stabiso.com/mcp (the steps of connected apps), then sign in as the auditor and allow it.

• The app gets what the auditor holds that an app may have: read. It never drafts, posts or approves.
• Its key acts for the auditor (api_key.acts_for): it stops working the moment the auditor's access ends or they are disabled, and starts again if the date is moved before that.
• Every tool it calls is in the auditor's access log with its arguments, marked with the app's name.

The access log

Settings → Auditors → Access log, or GET /v1/access-log (an administrator), lists every request of the organization's auditors, newest first, with user_id for one auditor and before to page:

The log is kept as security events of kind auditor.request: append-only for every database role, readable only by the organization's own administrators, and in the organization's export like every other security event.

Audit files

The files an auditor downloads are made by GET /v1/entities/{entity}/audit-files/... and the Reports → Audit files page: the French FEC, the German GoBD data carrier, and, for every other country, the OECD SAF-T file and the evidence pack. Which standard each country expects, and why, is in the standards overview of 2026-10-24.