How we protect your data

riskregister.com runs on managed, reputable cloud infrastructure. The application and its content delivery are hosted on Vercel; customer data is stored in a managed PostgreSQL database on Supabase.

All traffic to and from the Service is encrypted in transit with TLS. Data is encrypted at rest by our hosting and database providers.

Every organisation’s data is isolated at the database layer using PostgreSQL row-level security. Requests from your members, and from API and AI-assistant clients, run under a database role that cannot bypass row-level security and is scoped to a single organisation, so one organisation’s data is never visible to another — the boundary is enforced by the database as well as by application code. A small set of reviewed system paths run under a privileged database role and are kept to one organisation by application checks: for example, scheduled jobs, billing webhooks, sign-up and sign-in lookups, API token authentication, invitation and share-link resolution, and our internal operator console.

• Passwordless sign-in. Production accounts authenticate with a one-time code sent to their email, so there are no passwords to reuse, phish or leak.
• Scoped programmatic access. The REST API and MCP server use organisation API keys and personal access tokens. Tokens are stored only as hashes, are revocable at any time, and are constrained by per-token rate limits.
• Role-based permissions. Access within an organisation is governed by member roles, following the principle of least privilege.

Actions taken in your account are recorded in an append-only audit log. The log captures who did what and when, together with the IP address and user agent of each recorded action, including views of a register shared by link. The application’s database role cannot edit or delete audit records, and no member, API or assistant action can remove them, so the trail stands up as compliance evidence. Records are deleted only when an organisation is permanently deleted, or, for an Enterprise organisation that sets a retention window of at least a year, once they are older than it.

You own your data. You can export it at any time as CSV, Excel, JSON or PDF, including a GDPR-oriented export variant. How we process personal data is described in our Privacy Policy and, for customers acting as data controllers, our Data Processing Agreement.

We rely on a small set of established subprocessors to deliver the Service. Each processes data only as needed for its function:

• Vercel — Application hosting, content delivery and bot protection.
• Supabase — Managed PostgreSQL database hosting.
• Clerk — Authentication and identity (email one-time-code sign-in).
• Stripe — Payment processing and subscription billing.
• Resend — Transactional email delivery.
• Anthropic — AI-assisted risk generation, suggestions and categorisation.
• Apollo — Company information lookup from your organisation's web domain, to prefill its profile.
• Upstash — Rate limiting (managed Redis).
• Sentry — Application error monitoring.
• Inngest — Background job orchestration (webhook delivery, reminders).
• PostHog (EU) — Product analytics and session recordings, without cookies and with all on-screen text and everything typed masked, processed and stored in the EU (Frankfurt).

The current list, with each provider’s role, is maintained in our Privacy Policy. Where each provider processes data, and the transfer safeguards in place, are available on request.

• Daily database backups, managed by our database provider and kept for seven days.
• Independent uptime monitoring of the application and its database every three minutes, with a public status page at status.riskregister.com.
• Application error monitoring so issues are detected and investigated quickly.
• Rate limiting across authentication and the public API to protect availability.
• Durable, at-least-once webhook delivery so integration events are not lost on a transient failure.

If you believe you have found a security vulnerability, please email support@riskregister.com with the details. We investigate every report and appreciate disclosures made in good faith. We ask that you give us a reasonable opportunity to respond and remediate before any public disclosure, and that you avoid privacy violations and service disruption while testing.

We are not yet independently certified to SOC 2 or ISO 27001. Rather than imply otherwise, we describe the controls we operate today — tenant isolation, encryption, passwordless authentication, least-privilege access and an append-only audit trail — which are the building blocks those frameworks assess.

SOC 2 is on our roadmap. If you have a specific assurance requirement, contact us and we will tell you honestly where we stand.

The customer database runs on Supabase in AWS’s London region (eu-west-2), and the application’s server functions run in London too, though requests may pass through Vercel’s global network on the way. Some of the subprocessors listed above, including our AI provider, process data in other regions, including the United States. We do not yet offer a choice of processing region. We retain data for the life of your account and for a limited period afterwards to meet legal and security obligations; a published retention schedule will accompany our compliance documentation. See our Privacy Policy for detail.

For security or privacy questions, contact support@riskregister.com.