Respond by offering a scoped, remote, evidence-based review before agreeing to anything on site. Define what is in scope, who attends, how long it runs, and which materials stay confidential. Multi-tenant vendors cannot expose other customers' data, so most audits are document and interview driven.
Why customers ask
An audit request usually comes from a buyer's regulator, their own policy for critical suppliers, or a specific concern raised during review. It is rarely hostile. It is a way to move from "we read your answers" to "we saw how it works." Treat the request as a sign the customer takes your service seriously.
What a multi-tenant vendor can and cannot allow
Your service runs many customers on shared infrastructure. A single customer cannot walk the data center, probe the production network, or view logs that contain other tenants' information. Say this early and calmly, and explain the alternatives you offer instead.
| Customer request | Common safe alternative |
|---|---|
| On-site visit to hosting facility | Provider's third-party reports and your hosting region details |
| Network scan of production | Summary of your independent test, or a test against a dedicated staging environment |
| Read access to all logs | Redacted sample of logs for their own tenant, plus your logging standard |
| Interview your engineers | Scheduled call with named owners and an agenda |
| Review of source code | Secure development evidence, review settings, and scan summaries |
A response in five steps
- Acknowledge and ask for purpose. What is driving the audit? A regulator's expectation calls for different evidence than a one-off concern.
- Check the contract. Your agreement may already describe audit rights, frequency, notice and cost. Your counsel owns that reading. Your job is to bring the facts.
- Propose scope in writing. Systems, controls, time window, locations, attendees, and a named contact for each side.
- Provide the evidence pack first. Many audits end with documents and one call. See being assessed as a vendor: the evidence pack.
- Record findings and actions. Keep a shared list with owners and dates. Close items with evidence.
For more on how the clause itself reads from the buyer side, see right to audit clause: what to ask from a vendor.
Ground rules to set
- Confidentiality. The customer signs an NDA or relies on the existing one, and findings about your environment stay between you.
- Frequency and cost. If the contract is silent, agree on both before starting, and set a limit on repeats.
- Observers. Say who may attend. A customer's consultant is fine if they are bound by the same confidentiality terms.
- Remediation. Agree that findings are logged with severity and a target date, and that you are not committing to features the product does not have.
Prepare so the audit is boring
The smoothest audits are the dull ones. Keep policies dated, keep an evidence folder updated through the year, and name an internal coordinator. The post on evidence folder naming and structure for audits shows a layout that works under time pressure.
When the request is too broad
If a customer demands access you cannot give without exposing others, say no to that item and offer the nearest safe option. Put it in writing and keep the tone factual. Most reviewers accept a reasoned limit when you pair it with a concrete alternative.
Safeguard's compliance and evidence automation can help gather the dated records that audits ask for, which keeps the preparation work small.
Quick check
Can we refuse an audit request outright?
Check your contract first, since it may grant audit rights. Where it does not, a refusal with no alternative usually damages trust. Offer a scoped review instead.
Should the audit include a penetration test by the customer?
Not on shared production without agreed rules. Offer your own independent test summary, or a test window against a separate environment, under written terms.
Last reviewed: 19 October 2026.
