For larger adult platforms that meet California’s cybersecurity audit thresholds

The firm that built your security cannot audit it.

Parapet works out, from each year’s revenue and consumer counts, whether California’s privacy regulations require a yearly independent cybersecurity audit, when the first report is due — April 1, 2028, 2029 or 2030 by size — and keeps every audit: the auditor and whether they are truly independent, the findings open and fixed, and the executive’s certification.

Open the demo See pricing

Opens in this browser with an invented cam platform already in it. No account, no email address, nothing installed.

Open the free demo →

The problem

A yearly audit, a report and a signature, every April 1.

The California Privacy Protection Agency’s regulations, in force from 2026, require a yearly independent cybersecurity audit from a business that made half its revenue selling or sharing personal information, or was over the revenue threshold and handled enough consumers’ data. The first report is due by size; every year after, a report and an executive’s certification go in by April 1.

Audit requirements

the same regulations implement cybersecurity audits for certain businesses.

California Privacy Protection Agency →

April 1, 2028

the first report for a business over $100 million in 2026; 2029 and 2030 for smaller ones.

Independent

not the firm that built the security program.

Will not certify before the report is in.

A certification dated before the report is refused. An auditor that built the security program is called out as not independent. Missing year figures, an open finding and no named certifying executive are each on the file. Each audit carries its five-year retention date.

How it works

Figures, audits, the file

Enter each year’s figures

Gross revenue, consumers or households, sensitive-data consumers and share of revenue from selling data. Parapet says what each year means.

Run each audit

The year it covers, the auditor and their independence, the report, findings open and fixed, and the certification.

Print the file

Every finding, the figures and each audit with how long to keep it.

What it will never do

It keeps the calendar. It certifies nothing.

Parapet tells you what is owed and when. The certification is your executive’s, to the Agency.

No submission.Nothing goes to the Agency from Parapet.

No auditing.Your independent auditor audits; Parapet keeps the record.

It is not a lawyer.Not legal advice.

It never touches a payment.The subscription is for software.

Pricing

Priced per business

A rounding error beside the audit itself.

Most platforms

One business

$49/month

One larger adult platform.

Thresholds worked each year
First and yearly due dates
Independence and findings

One business, yearly

$490/year

The same, two months free.

Everything in One business
Five-year retention
Export for your counsel

Subscription. Your bank statement says Parapet Software. Refunded in full on request within 30 days. Your licence key is emailed to you within two working days of payment.

Checkout is our own bitcoin server, not a card processor — nobody we had to apply to and nobody who can close the account. The button takes you straight to it. Give your email address there — that is where your key is sent.

Questions

The ones we actually get asked

Do we need an audit at all?

If half your revenue came from selling or sharing personal information, or you were over the revenue threshold and handled 250,000 consumers or 50,000 consumers’ sensitive data. Parapet works it out each year.

Who can audit?

Someone truly independent — not the firm that built the security program.

What threshold does Parapet use?

It starts at $26,625,000. The Agency adjusts it, so you can change it.

Is this legal advice?

No. It is the calendar your counsel needs.

What do I actually get when I pay?

The demo on this page is the whole program, running on invented records. Paying gets you a licence key — one line of text, emailed to the address you give at checkout within two working days. Paste it into the program and from then on it keeps your own records. Until then, nothing you type into it is kept.

The key is checked inside the page, on your own machine. It never calls us, so there is still no account and nothing about your business goes anywhere. If you ever stop paying, your records stay exactly where they are, read-only, and Export still hands you every one of them.

Open the demo before the first audit

The invented cam platform at about $140 million owes its first audit covering 2027. Its auditor built its security program, its 2025 counts are missing, and nobody is named to certify. Parapet shows every one.

Open the demo See pricing