Privacy Policy

riskregister.com is operated by ISOSOC Advisory Ltd, a company registered in England and Wales (company number 17254731) (“we”, “us”). We are the controller of the personal data described in this policy, except where we process data on behalf of a customer organisation, in which case that organisation is the controller and we act as its processor under our Data Processing Agreement. Our registered address is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We collect:

• Account data — your email address, your display name, and your role within an organisation.
• Organisation data — the organisation name you provide at sign-up, and the optional sector, size band and region you may add to your organisation profile later.
• Content you create — risks, controls, scopes, comments and related records. This is your data; it may incidentally contain personal data you choose to enter.
• Usage and audit data — an append-only audit log of actions taken in your account, including the acting user, the IP address and user agent of each recorded action, and timestamps. Views of a register shared by link are recorded too, with the viewer’s IP address and user agent, including viewers who have no account.
• Product analytics — how you use the Service and our website, processed by PostHog in the EU: the pages you visit (their full addresses, with any access key in a shared or invitation link and any search you typed removed, and the page title only on our public pages) and the page that referred you; where on a page you click and what kind of element it is, without its text; and, only if you allow it, recordings of your visits, in which everything shown on screen, including register content such as risk titles and descriptions and the names of people, is masked, as is everything you type, and in which a newly created token, key or secret, or a share or invitation link, is never recorded at all; and events such as creating a workspace or a register, connecting an AI assistant, and an assistant’s or a script’s use of our API. If you allow it, what you do while signed in is linked to your account (including your name and email address) and your organisation; otherwise browsing statistics stay anonymous. In the EU and EEA, none of this is collected in your browser unless you allow it. We use no cookies for this. It is not collected when your browser sends a Do Not Track or Global Privacy Control signal, or after you switch it off in the Cookie Policy.
• How you found us — when you sign up, the domain of the website that referred you (for example chatgpt.com, never the full address), any campaign tags in the link you followed (utm_source, utm_medium and utm_campaign), and the kind of page you first arrived on. We read these from the page you arrive on without using cookies, do not collect them for this purpose when your browser sends a Do Not Track or Global Privacy Control signal, and hold them with your sign-in account. If you then create an organisation, we keep them with its record and remove the copy held with your sign-in account; if you join an existing organisation instead, they are not added to it and remain with your sign-in account.
• Billing data — for paid plans, subscription and payment metadata processed through Stripe. We do not store full card numbers.
• Support communications — messages you send us.

• To provide, secure and support the Service — on the basis of performing our contract with you.
• To maintain the audit log, prevent abuse and keep the Service reliable — on the basis of our legitimate interests in security and integrity.
• To understand how people find and use the Service, and which routes lead to lasting use, so we can improve it: anonymous statistics and events in the Service on the basis of our legitimate interests in running and developing the Service, and session recordings and analytics linked to you on the basis of your consent. You can withdraw consent or object at any time from the Cookie Policy or “Privacy choices” in our website’s footer.
• To process payments and manage subscriptions — on the basis of performing our contract and complying with legal obligations.
• To send service and review-reminder emails you have not opted out of — on the basis of our legitimate interests, subject to your notification preferences.
• To meet legal and accounting obligations — on the basis of legal obligation.

We use the following third-party subprocessors to deliver the Service. Each processes personal data only as needed for its function and under its own data-processing terms:

• Vercel — Application hosting, content delivery and bot protection.
• Supabase — Managed PostgreSQL database hosting.
• Clerk — Authentication and identity (email one-time-code sign-in).
• Stripe — Payment processing and subscription billing.
• Resend — Transactional email delivery.
• Anthropic — AI-assisted risk generation, suggestions and categorisation.
• Apollo — Company information lookup from your organisation's web domain, to prefill its profile.
• Upstash — Rate limiting (managed Redis).
• Sentry — Application error monitoring.
• Inngest — Background job orchestration (webhook delivery, reminders).
• PostHog (EU) — Product analytics and session recordings, without cookies and with all on-screen text and everything typed masked, processed and stored in the EU (Frankfurt).

Some of our subprocessors are located outside your country, including the United States. Where personal data is transferred internationally, we rely on appropriate safeguards — the EU Standard Contractual Clauses and, for transfers from the UK, the UK International Data Transfer Addendum. Details of each subprocessor’s location and safeguards are available on request.

We keep personal data for as long as your account is active and for a limited period afterwards to meet legal, accounting and security obligations. Audit-log records are retained as part of the Service’s integrity guarantees for as long as your organisation’s account exists; an organisation on the Enterprise plan can set a retention window of at least one year, after which older records are deleted. When data is no longer needed, we delete or anonymise it.

If you delete your account, we anonymise it in place: your name and email address are removed from your account record and your sign-in identity is deleted, so the Service no longer holds a live identity for you. Audit-log records are not rewritten — they are retained unchanged, on the legal bases above, because they are your organisation’s compliance record; they are deleted when your organisation’s account is deleted or, if it has set a retention window, once they are older than it.

We apply technical and organisational measures appropriate to the risk, including:

• strict tenant isolation enforced in the database (row-level security), so one organisation cannot access another’s data;
• encryption of data in transit (TLS) and at rest at our hosting and database providers;
• passwordless authentication, removing the risk of reused or stolen passwords;
• an append-only audit log of changes;
• least-privilege access controls and rate limiting; and
• automated-traffic checks (Clerk’s bot protection at sign-in and Vercel BotID on AI features and workspace creation), which read technical signals from your browser to tell people from scripts.

Depending on your location, you may have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. To exercise these rights, contact us using the details below. You also have the right to complain to a data protection authority — in the UK, the Information Commissioner’s Office (ICO).

Where we process data as a processor on behalf of a customer organisation, please direct your request to that organisation; we will assist it in responding.

We use only essential and functional cookies; product analytics runs without cookies. See our Cookie Policy for details.

The Service is intended for organisational use by adults and is not directed at children. We do not knowingly collect personal data from children.

We may update this policy from time to time. We will post the updated version here and, for material changes, take reasonable steps to notify you.

For privacy questions or to exercise your rights, contact privacy@riskregister.com. We have not appointed a statutory Data Protection Officer; the address above is our data protection contact.