Security

It covers the RISKOPILOT web application at riskopilot.com, its API and background functions, and the managed database, authentication and file storage behind them. It does not cover your own corporate systems, email, or any third-party tool you connect to outside the product.

Every application table enforces row-level security in the database, so an authenticated user only reaches records tied to their own account, organisation membership, or an explicit share. Access is not decided in the browser: it is enforced server-side on each query.

Administrative capability is granted through a dedicated roles table, never through a field on a user profile and never through anything stored in the browser. Elevated privileges are checked server-side on every request.

Server-side functions that handle analysis, email automation or administration require a valid authenticated session, an administrator role, or an internal service credential before they perform any work. Public forms (contact, newsletter, lead capture) accept unauthenticated input by design, and are validated, throttled per source address, and cannot read existing records.

All traffic to riskopilot.com and to our API is served over HTTPS with HSTS enabled. Database and file storage are encrypted at rest by our managed infrastructure provider.

Application data is hosted in the European Union — Ireland (AWS eu-west-1). Payment card data never reaches our systems — checkout is handled entirely by Stripe, and we retain only Stripe customer and session identifiers.

Uploaded documents used for report auditing are processed and then removed; only the resulting scores are retained. PDF and slide exports are generated in your browser, so report content is not re-uploaded to produce a download.

Verified on the production origin today: HTTP Strict Transport Security, MIME-type sniffing protection (X-Content-Type-Options: nosniff) and a strict-origin-when-cross-origin referrer policy.

A stricter header set — frame-ancestors denial, a Permissions-Policy and a Content Security Policy — is configured in our repository but is not currently emitted by our hosting platform, so we do not claim it as an active control. In the meantime the application refuses to run inside a third-party frame client-side. We re-check the live headers on each release and will state enforcement here once the platform applies them.

Our analysis models run behind a fixed security layer that pins the model's identity and scope, treats all narratives, documents and questions strictly as data rather than instructions, and blocks attempts to extract configuration or cross-reference another customer's investigation. Model output is schema-validated and checked for cross-tenant leakage before it is stored or returned.

Models are used to analyse the content you submit for your own investigation. We do not sell your investigation data, and we do not publish it.

Content submitted by users is escaped before it is rendered into notification emails, and email headers are sanitised, so submitted text cannot inject markup or additional headers. Request bodies are schema-validated at the edge, and sensitive operations are rate limited.

Dependencies are monitored and upgraded when advisories affect us. Automated checks run on our release pipeline, including tests that assert every email automation endpoint still refuses anonymous and unauthorised callers.

We rely on the following providers to deliver the service:

• Lovable — application hosting and delivery
• Supabase — managed database, authentication, file storage and serverless functions (EU region)
• Stripe — payment processing
• Resend — transactional and lifecycle email delivery
• Google — AI model inference, analytics and advertising measurement

Our Privacy Policy sets out lawful bases, retention and your data subject rights. For a data processing agreement or a completed security questionnaire, email security@riskopilot.com.

We welcome responsible disclosure. Email security@riskopilot.com with a description of the issue, reproduction steps, the affected URL or component, and how to contact you.

Our commitments to you:

• We acknowledge receipt within 2 business days.
• We provide a remediation timeline within 7 business days.
• We credit you publicly, with your consent, once the fix ships.

Please do not:

• Run automated scanners against production without prior approval.
• Access, modify or exfiltrate data belonging to other users.
• Disclose the issue publicly before we have remediated it.

Machine-readable contact details are published at /.well-known/security.txt.

We do not claim to be certified under SOC 2, ISO 27001, PCI DSS or HIPAA, and we do not claim any system is unbreachable or free of vulnerabilities. Where an independent assessment has not been performed, we say so rather than implying one.

This page describes controls in place at the review date above. We revise it when our hosting, providers, encryption, or access model change, and at least annually.

Separately from this page, our hosting platform publishes a trust centre for this deployment at /.well-known/trust.html (machine-readable at /.well-known/trust.json). That route is reserved and served by the platform, not by our application, and its contents are generated independently of the statement above. Nothing on this page is issued, verified or attested by the platform.