Privacy Policy & Cookie Notice

Information we control. Risk Vault determines how information is processed when you visit our website, communicate with us, create or administer an account directly with us, or interact with us in another business capacity. This Policy applies to those activities.

Customer-controlled information. Organizations use Risk Vault to manage risks, controls, assets, surveys, reports, workflows, users, and attachments. When we process that content under a customer’s instructions, the customer organization is responsible for deciding why and how it is processed, and Risk Vault acts as its service provider or processor. The customer’s privacy notice and agreement with Risk Vault govern that processing. If your account was provided by your employer or another organization, direct questions about its records to that organization first.

This Policy does not cover third-party websites, identity providers, or integrations that operate under their own privacy policies.

Category	Examples	Primary purposes
Account and professional information	Name, email address, username, telephone number, job title, time zone, employer, business unit, roles, permissions, and account status.	Create and administer accounts; authenticate users; enforce authorization; provide support.
Authentication and security information	Password hash, multi-factor authentication configuration, external identity identifiers and claims, login history, IP address, browser/user-agent information, session data, agreement acceptance, and security and audit events.	Authenticate users; prevent fraud and abuse; investigate incidents; maintain auditability.
Customer content	Risk, control, asset, incident, survey, compliance, workflow and report data; comments; names and work contact details assigned to records; uploaded documents and attachments; and other content submitted by users.	Provide the customer-directed risk-management Service and its collaboration, reporting, notification and recordkeeping functions.
Integration information	Connection settings, encrypted credentials or tokens, identifiers, webhook data, and records exchanged with identity providers, Jira, SCIM, SIEM, MCP clients, or other integrations enabled by an administrator.	Connect and synchronize systems at the customer’s direction; secure and troubleshoot integrations.
Device, usage and diagnostic information	IP address, browser and device information, pages or features used, timestamps, request and correlation identifiers, error records, performance data, and security telemetry.	Operate, secure, diagnose and improve the reliability of the Service.
Communications	Support requests, administrative messages, feedback, and related correspondence.	Respond to requests; provide support; manage our relationship with you or your organization.

Sources. We receive information directly from you; from your organization and its administrators; automatically from your browser or device; from identity providers and integrations you or your organization enable; and from service providers that help us operate and secure the Service.

Information about other people. You may enter another person’s business contact details when assigning records, inviting users, or configuring notifications. Only provide information you are authorized to provide.

Free-form and uploaded content. Risk Vault is designed for organizational risk information, not consumer financial accounts, government identification numbers, precise geolocation, medical records, or other unnecessary sensitive personal information. Do not place such information in free-text fields, AI prompts, survey responses, or attachments unless your organization has determined it is necessary and authorized.

Technology	Purpose	Typical duration
Authentication and session cookies	Keep you signed in, maintain a secure server session, support external sign-in, and route authenticated requests.	The browser session or the configured account-session period.
Security cookies and tokens	Prevent cross-site request forgery, preserve secure authentication state, and support fraud and replay protections.	Usually the browser session or the time needed to complete the protected request or sign-in flow.
Local and session storage	Remember interface preferences, recent searches, panel state and temporary form or survey drafts in your browser.	Session items end with the tab or session. Local items remain until replaced, cleared by the feature, or deleted through browser controls.

Your organization and authorized users. Customer content and account information may be available to customer administrators and other users according to configured roles, permissions, business-unit scope and sharing settings.

Infrastructure and operational providers. Providers may process information to host databases and files, encrypt and manage secrets, deliver email, cache application data, scan uploaded files for malware, monitor infrastructure, or provide technical support. Current deployments may use Amazon Web Services, Microsoft technologies, Redis infrastructure, an SMTP provider, and—when enabled—Cloudmersive malware scanning. Providers process information only for the services they supply and subject to applicable agreements.

Customer-configured identity and integration providers. If an administrator enables Google, Microsoft or another OpenID Connect identity provider, Jira, SCIM, SIEM, webhooks, MCP clients, or another integration, we exchange the information required to perform the requested connection. The third party also processes that information under its own terms and privacy notice.

Professional advisors. We may disclose information to lawyers, accountants, auditors, insurers and other professional advisors where reasonably necessary for their services.

Legal, safety and compliance recipients. We may disclose information to courts, regulators, law enforcement or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, property or the integrity of the Service.

Business transfers. Information may be reviewed or transferred as part of a proposed or completed financing, merger, acquisition, reorganization, insolvency or sale of some or all of our business or assets, subject to appropriate confidentiality protections.

At your direction. We may disclose information when you or your organization instructs us to do so or provides valid consent.

Risk Vault may offer optional features that send selected text, prompts and relevant record context to an AI service configured for the deployment. The current supported configuration uses a separately operated llama.cpp model server; administrators can disable AI features.

AI input and output may contain personal or confidential information if a user includes it. Users should review generated output before relying on or saving it and should not submit information that their organization has not authorized for AI processing.

We do not use customer content, prompts or outputs to train generalized AI models. If Risk Vault introduces a third-party AI provider or materially changes these practices, we will update this Policy and applicable customer documentation before the new processing applies.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, follow customer instructions, maintain security and audit records, comply with legal and contractual obligations, resolve disputes, and enforce agreements.

Customer administrators can configure record-retention requirements. The platform’s default business-record retention setting is seven years, but an organization may select a different period and may place records on legal hold. Report artifacts and short-lived integration or workflow data may have shorter configured periods. Deactivated user records may be preserved where needed to maintain the integrity of audit trails and historical assignments.

Backups are protected and expire according to backup schedules. When information is no longer required, we delete it, anonymize it, or isolate it from ordinary use unless continued retention is required or permitted by law. Browser-local drafts and preferences remain on the device until the feature or user clears them.