Security at RiskShield AI

Your data is protected both while moving and at rest.

• In transit: all endpoints are served exclusively over HTTPS with modern TLS, and HTTP Strict Transport Security (HSTS) instructs browsers to refuse any non-encrypted connection.
• At rest: database storage and uploaded documents are encrypted with AES-256 on our managed cloud infrastructure.

Every customer’s data is logically isolated. Tenant tables are protected by database Row-Level Security policies that scope each signed-in user’s requests to their own organization, so isolation is enforced by the database itself rather than by application code alone.

API keys, database connection strings, and signing secrets are never embedded in client-side code or source control. They are stored in encrypted environment-variable vaults and injected only into trusted server-side runtimes.

Two-factor authentication is on by default: after signing in with a password, users confirm a one-time code sent to their email, and authenticator-app (TOTP) codes are also supported. The two-factor verification is held in a signed, HTTP-only, Secure cookie that cannot be read by browser scripts or reused on another account. Administrative capabilities are gated behind server-side role checks so that sensitive actions are limited to authorized users.

Sensitive actions — including sign-ins, risk-score overrides, role grants, two-factor changes, data and document exports, and vendor status and compliance updates — are written to a dedicated, append-only audit log that the database blocks from being edited or deleted. Each entry records the timestamp, acting user, organization, action, before-and-after values, and request context (IP address and user agent).

AI-generated assessments are labeled as decision-support output, not final determinations. Reviewers can edit findings before a report is finalized and override the AI-suggested risk score, and every risk-score override is recorded to the audit trail.

The application runs on managed cloud infrastructure with platform-level firewall and DDoS mitigation. Sign-in attempts and public and AI endpoints are rate limited to help defend against brute-force and abuse, and production errors are monitored so issues are detected and addressed quickly.

If you believe you have found a security vulnerability, please contact us at support@riskshieldai.com. We investigate all reports and appreciate responsible disclosure.