Security at RiskShield AI

Your data is protected both while moving and at rest.

• In transit: all endpoints are served exclusively over HTTPS with modern TLS, and HTTP Strict Transport Security (HSTS) instructs browsers to refuse any non-encrypted connection.
• At rest: database storage and uploaded documents are encrypted with AES-256 on our managed cloud infrastructure.

Every customer's data is logically isolated. Database access is enforced with Row-Level Security so that one organization can never query, read, or modify another organization's records — isolation is applied at the data layer, not merely in application code.

API keys, database connection strings, and signing secrets are never embedded in client-side code or source control. They are stored in encrypted environment-variable vaults and injected only into trusted server-side runtimes.

Accounts support multi-factor authentication (MFA/2FA), and sessions are managed with secure, HTTP-only cookies. Administrative capabilities are gated behind role checks so that sensitive actions are limited to authorized users. Enterprise single sign-on (SSO via SAML/OIDC) is available on Enterprise plans. Contact us at support@riskshieldai.com to configure SSO for your organization.

Sensitive actions — sign-ins, risk-score overrides, permission and multi-factor changes, document uploads and exports, and vendor, compliance, and risk-status updates — are written to a dedicated, append-only audit log capturing the timestamp, acting user, organization, action type, before-and-after values, and request context (IP address and user agent) for accountability and defensibility.

AI-generated risk scores and summaries are clearly labeled as decision-support output. A compliance officer can review, edit, or override any automated classification, and every override is recorded to the audit trail. Documents processed by AI are handled under enterprise data-protection terms and are not used to train third-party foundation models.

Databases are backed up with point-in-time recovery to support defined recovery objectives. The application runs behind platform-level monitoring, rate limiting, and web-application-firewall protections that help defend against brute-force and denial-of-service attacks.

If you believe you have found a security vulnerability, please contact us at support@riskshieldai.com. We investigate all reports and appreciate responsible disclosure.