Auralis security review checklist for an e-automate pilot

The pilot runs on your own data and calls, with agreed success criteria before any contract. IT should review access, hosting and controls before the pilot begins. Here are the questions we’d expect an IT lead to document before the pilot.

1. Which e-automate objects can it reach? Auralis connects to e-automate as an ECI partner integration, through the ESN API, under a service account that you create. That account is scoped to the objects you approve: contracts, meters, supplies, service calls, invoices and parts. Nothing on that list is on by default, and you grant or revoke each one yourself, without a call to us. Ask for the object list in writing and compare it with the permissions on the service account before anything is switched on.

1. What can it do without a person? Every write is checked against two rules: what it may touch, and when it may act alone. A meter read inside the variance you set posts on its own. A read outside that variance, a disputed invoice amount, or a request the system hasn’t seen before stops and goes to a person, with the reason attached. Ask to see the thresholds set for your account before the pilot runs, and ask which of them your team can change.

1. Where does the data sit? There are three hosting options: fully managed in Auralis cloud on an isolated tenant, in your own Azure environment, or on-prem with support on your hardware. The e-automate write path is the same in all three, so the choice changes where the model and the logs sit. Settle this before the pilot starts, and pick the option your policy already allows.

1. What is on file? Auralis is audited for SOC 2 Type II and ISO 27001, with reports available under NDA. It offers GDPR terms with a data processing agreement and a published sub-processor list. Ask for the reports and the agreement now, so they are in the file before the pilot is signed off.

1. What product-security evidence should we request? The CISA Secure by Demand Guide notes that there are many procurement compliance standards that focus on enterprise security, and that “relatively few focus on product security.” The guide lists a software bill of materials as something buyers can ask software makers for, in a standard, machine-readable format. Ask whether Auralis can provide a software bill of materials in a standard, machine-readable format.

1. How is data encrypted, and who can get in? Data moves over TLS 1.2 or later and sits encrypted at rest with AES-256. Access is role-based. Ask which roles exist on your account and who holds each one, so the access list is one your team has already approved.

1. Is every read, write and hand-off recorded? The audit log captures every read, every write and every hand-off to a person. Ask how long the log is kept, and whether that matches the investigation period in your own policy. If your policy requires longer retention, agree it before the pilot.

1. Is the training and retention position clear? Customer data is not used to train models. Retention defaults to 30 days, and you can set it to match your policy. Record the agreed retention setting in the pilot agreement.

1. What happens when something breaks? If e-automate is unreachable, Auralis keeps taking calls and emails, tells the customer a person will confirm, and queues the writes. Each queued action checks the record again before it posts. If Auralis itself is unreachable, your phone number and inboxes fall back to your team as they worked before. To stop every read and write, revoke the service account. Test that revocation during the pilot, with someone on your team who is allowed to do it.

1. Does the pilot run on your own data? The demo runs on a sample of your real e-automate data, so you can see the permission scope, the thresholds and the audit log before any workflow goes live. The step after the demo is a pilot on your own data and calls, with success criteria agreed before any contract is signed.

IT should document the answer to each applicable item before approving the pilot. Use the one-pager to open the review, and bring this list to the first call with your service leader. Book a 30-minute walkthrough with your IT lead on access, hosting and the audit log.

Sources

• CISA, Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem, with the FBI, released August 6, 2024 (CISA alert).
• Auralis, Security and hosting for an AI help desk on e-automate, one-pager, September 2026 (see the one-pager). Auralis product information (internal).