Trust and security

The architectural principle

Verdicts are computed, never generated

Every insurability verdict RiskBorne produces is the output of deterministic rules evaluated over carrier requirements stored verbatim from policy forms we hold. The same inputs always produce the same verdict, and every non-covered verdict names the carrier clause that produced it. No language model participates in a coverage decision. Models are used only to draft intake summaries, explain a finding in plain language, and suggest remediation steps — all of which a person reviews and none of which change a verdict.

Data handling

Your data, plainly

What we store

Your organisation profile, the agent profiles you enter, every scan and the verdicts computed from them, cures and their evidence, connector configuration and the monitoring signals it returns, submissions you prepare, and an audit trail of actions taken in your workspace.

Where it is stored

In a managed Postgres database and object storage operated by Supabase on AWS, encrypted at rest. All traffic to RiskBorne is over TLS.

Who can access it

Members of your workspace, scoped by row-level security in the database itself rather than by application code alone. RiskBorne staff cannot read your workspace casually: support access requires a platform role, a second authentication factor, a written reason, and it is read-only, time-boxed to 60 minutes and logged route by route.

Your data never trains a model

Verdicts are computed by deterministic rules, not generated by a model. Where a model is used — drafting an intake summary, explaining a finding in plain language — the content is not retained by the provider for training, and no customer data is used to train RiskBorne models. We do not have any.

What connectors read

Read-only monitoring metadata: whether traces exist, run counts, evaluation and error rates, alert configuration, timestamps. Connectors do not read prompt or completion content, personal data in payloads, or anything they are not scoped to by the credential you supply.

Retention and deletion

Scan and verdict history is kept indefinitely by default because it is your coverage record; you can shorten it. Quill conversations default to 12 months. You can export everything at any time, and request deletion, which enters a 30-day reversible window before tenant data is hard-deleted from both the database and object storage.

Connectors

What a connector reads, and what it does not

Credentials are encrypted at the application layer before storage and are never returned to the browser. A connector can be disconnected at any time, which deletes its stored credential.

Access

Authentication and staff access

Two-factor authentication with an authenticator app is available to every customer, and an organisation owner can require it for all members. It is mandatory for every RiskBorne employee holding any platform role, enforced in the server rather than the interface, and a fresh second factor is required again before any sensitive operation.

Support staff cannot browse your workspace freely. Viewing a customer workspace requires a written reason recorded before access begins, is read-only, expires after 60 minutes, displays a persistent banner, and logs every route visited. You can see your own organisation's audit trail in Settings.

Subprocessors

Who else touches the data

Honesty

What we have not done

• No SOC 2 or ISO 27001 certification. We build against those controls; we do not hold the reports.
• No independent penetration test has been performed yet. One is planned before general availability.
• Our incident response process is documented but has not been exercised with an external party.
• Point-in-time database recovery depends on the hosting plan in force for a given deployment; the register has its own scheduled backup regardless.

Reporting

Reporting a vulnerability

Email security@riskborne.com. We acknowledge reports within two business days, keep you updated while we fix the issue, and will not pursue action against good-faith research. The same contact is published at /.well-known/security.txt.

Questionnaire

Standard security questions, pre-answered

Where is customer data stored and processed?

Managed Postgres and object storage operated by Supabase on AWS. The application runs on Cloudflare's edge network. Region is fixed per deployment and can be confirmed on request.

Is customer data segregated between tenants?

Logically, by row-level security policies enforced in the database on every table holding customer data. Every policy scopes rows to the caller's organisation membership; no query path bypasses it except explicitly audited service-role jobs.

Is data encrypted in transit and at rest?

In transit over TLS 1.2 or higher. At rest by the storage provider's disk-level encryption. Connector credentials are additionally encrypted at the application layer before they are written, and are never returned to the client.

How is access to production controlled?

Platform privilege lives in a dedicated roles table, separate from tenancy, and is granted only by a superadmin. Roles are least-privilege: register editing, register review, support, read-only. Support access to customer data is read-only, reason-captured, time-boxed and logged.

Is multi-factor authentication available and enforced?

TOTP MFA is available to all customers self-service, and an organisation owner can require it for every member. MFA is mandatory for all RiskBorne staff holding any platform role, enforced server-side, with a fresh assurance level required for sensitive operations.

What is logged?

An append-only audit log records verdict computation with its corpus date, requirement approvals and supersedes, evidence uploads and deletions, connector changes, submissions, exports and deletion requests, platform-role changes, impersonation sessions, and Quill interactions including refusals. Security events are recorded separately. Customers can read their own organisation's audit trail in Settings.

What are your retention periods?

Scan and verdict history: indefinite by default, configurable per organisation. Evidence documents: indefinite by default, configurable. Quill conversations: 12 months. Email delivery logs: 24 months. Billing and audit records are retained after deletion where we are obliged to keep them.

Which subprocessors do you use?

Supabase (database, authentication, object storage), Cloudflare (application hosting and edge delivery), Resend (transactional email), Stripe (billing), DeepSeek via the Lovable AI gateway (assistant and narrative generation only, never verdicts).

Do you use customer data to train models?

No. Verdicts are computed by deterministic TypeScript rules over stored carrier requirements; no model participates in a coverage decision. Model use is confined to drafting and explanation, and customer data is not used for training by us or our providers.

What is your backup posture?

The database is backed up by the managed platform on its standard schedule with point-in-time recovery available on the production plan. In addition, the carrier requirement register — carriers, forms, requirements and framework crosswalks — is exported to versioned JSON in object storage on a scheduled job, because it is the asset we could not reconstruct.

Do you have an incident response process?

A documented internal process covering detection, containment, customer notification and post-incident review, with named responsibility. It has not yet been externally exercised or tabletop-tested with a third party.Not yet in place

Do you hold SOC 2, ISO 27001, or comparable certification?

No. RiskBorne is an early-stage company and holds no third-party security certification today. We build against the controls those frameworks describe and will pursue SOC 2 Type II when customer commitments justify it. We will not claim otherwise.Not yet in place

Has a penetration test been performed?

No independent penetration test has been performed to date. Automated dependency and configuration scanning runs continuously, and an external test is planned before general availability.Not yet in place

How should a vulnerability be reported?

By email to security@riskborne.com, also published at /.well-known/security.txt. We acknowledge reports within two business days and do not pursue good-faith researchers.