Cookie Policy

Cookies are small text files stored on your device when you visit a website. riskregister.com, operated by ISOSOC Advisory Ltd, uses a small number of cookies that are necessary to run the Service and to remember your preferences. We do not use advertising, analytics or cross-site tracking cookies.

These cookies are required for the Service to function and cannot be switched off without breaking core features such as signing in.

• Session cookie — keeps you signed in after you authenticate. Set by our authentication provider, with theSameSite=Laxattribute as part of our cross-site request protection.
• Authentication-flow cookies — short-lived cookies used only during the sign-in exchange to complete it securely.

These remember interface choices so the app behaves the way you left it. They hold preferences only — no personal data.

• ux-sidebar-collapsed — whether you collapsed the navigation sidebar.
• ux-register-list-view — whether you prefer the cards or table view of your registers.
• ux-plan-review — set only if you untick “Show me the plan before writing the risks” when generating a register, so we skip that step next time.
• rr-region — whether you are visiting from the EU or EEA, worked out from your connection’s country, so we know whether to ask before any analytics runs. It holds only eu or other and lasts 30 days.
• ux-setup-dismissed-… — that you dismissed the setup checklist on a workspace’s home page. There is one per workspace, named with the workspace’s internal ID.

Four features keep a value in your browser’s own storage rather than in a cookie. None is sent to us unless you act, and none is used for tracking.

• rr-analytics-consent (local storage) — your answer to “Help us improve Risk Register” (allow or no thanks), so we don’t ask again.
• rr-analytics-opt-out (local storage) — that you switched product analytics off in this browser (see below), so it stays off on later visits.
• rr.trial-t3.… (local storage) — that you dismissed the notice shown when a workspace’s trial ends, so it stays hidden in that browser.
• riskregister:pending-paste (session storage, this tab only) — on the import page, what you pasted, kept while you sign in or set up a workspace (or until your workspace can take it) so it is waiting when you come back. It holds whatever you pasted, which may include personal data, and it reaches us only when you choose to save it. It is cleared when you save, start again or sign out, and ignored after 30 minutes.

We use PostHog, processed in the EU, to understand how riskregister.com is used so we can improve it. Its script runs in your browser and stores nothing there: no cookie, and no local or session storage. What it records depends on where you are and what you choose.

• Outside the EU and EEA, unless you allow more: anonymous statistics only. The pages you visit (with any access key in a shared or invitation link, and any search you typed, removed), where you click but not the text of what you click, and your device type and page speed. Nothing is recorded and nothing is linked to you or your account. In the UK this is permitted without consent for statistics that improve the service, provided we explain it here and you can object, which the switch below does.
• If you allow it (the “Help us improve Risk Register” card): also recordings of your visits, in which all text on screen, including register content such as risk titles and descriptions, and everything you type is masked; and, when you are signed in, your activity is linked to your account and your organisation. A newly created token, key or secret, or a share or invitation link, is never recorded.
• In the EU and EEA: nothing runs until you allow it.

The Privacy Policy explains what we collect and why. Analytics does not run when your browser sends a Do Not Track or Global Privacy Control signal. You can change your answer at any time with Privacy choices (also in the footer), or switch analytics off entirely in this browser here; we then keep one value in your browser to remember the choice.

We do not use advertising cookies, analytics cookies, social-media cookies or any cross-site tracking technologies. We do not sell your data or share it with advertisers.

When you start a paid subscription, payment is handled by Stripe on Stripe’s own pages. Stripe may set its own cookies in that context to process the payment securely and prevent fraud. Those cookies are governed by Stripe’s cookie and privacy notices.

You can control or delete cookies and site storage through your browser settings. Because we use only essential and functional cookies, there is no advertising to opt out of; product analytics has its own switch above. Note that blocking essential cookies will prevent you from signing in and using the Service.

We will update this policy if our use of cookies changes. See our Privacy Policy for how we handle personal data, or contact privacy@riskregister.com with any questions.