Security
Security at Vivid Risk
How Vivid Risk protects the records you keep in it, where they are held, which security credentials we do and do not hold today, and how to report a vulnerability.
Security questions and reports: security@vividrisk.ai
Credentials
What an independent party has examined, stated as it stands today.
| Credential | Status | Detail |
|---|---|---|
| ISO/IEC 27001 certification | Not held | Not held. When we are certified, the certification body, the certificate number and its scope will be listed here. |
| Independent penetration test | Not held | Not yet carried out. When one is, the testing firm, the date and a summary letter will be available from this page. |
| Cyber Essentials (UK) | Not held | Not held. |
| SOC 2 report | Not held | Not held. SOC 2 is a US attestation; we will pursue it if customers require it. |
How the platform protects your records
- Separation between organisations
- Each organisation's records are separated by the database's own security rules, which check the signed-in person's organisation and practice on every read and write, not only on screen. Every change to those rules is tested against the database emulator before it is deployed.
- Identity
- Who is calling a server route is read from their verified sign-in token, never from what the request says about itself.
- Two-step sign-in
- Two-step sign-in with an authenticator app (TOTP) is built, and is not yet switched on for accounts.
- Sessions
- When access is withdrawn, the person's sessions are revoked on the server and the database rules refuse any sign-in token issued before that moment. An idle session ends after 8 hours.
- Abuse limits
- Every API route has a per-caller ceiling on requests, held on each server instance.
- Audit log
- Changes to records are written to an audit log, and the database rules give no one the right to edit or delete an entry.
- Report integrity
- Each issued report is linked into an HMAC-SHA256 chain for its organisation, so a later change to a stored report can be detected. That makes reports tamper-evident; it does not make them unchangeable.
- Evidence files
- Evidence files are stored privately and opened through short-lived signed links, never through a public address.
- Payments
- Card payments are taken on Stripe's own checkout page. Vivid Risk never receives or stores a card number.
- Change control
- Every deployment is gated on a full type check and the automated test suites, and the database rules are deployed only after their emulator tests pass.
Where your data is held
Each service, the location it holds or processes data in, and how we know that location. The full register, with what each service receives, is on the subprocessors page.
| Service | Location |
|---|---|
| Google Cloud — Cloud FirestoreThe database holding everything you enter into the product. | europe-west1 (Belgium) |
| Google Cloud — Cloud StorageHolds the evidence files you attach to a control, and nothing else. | europe-west1 (Belgium) |
| Google Cloud — Cloud RunThe application servers themselves. | europe-west1 (Belgium) |
| Google Cloud — Firebase AuthenticationSign-in, and the identity your records are keyed to. | Not region-configurable — we cannot choose or confirm it |
| Google Cloud — Gemini models on Vertex AIThe AI-assisted features — the evidence cross-mapper and the drafted narrative sections. | EU multi-region: generation through the eu endpoint, embeddings through the europe-west1 endpoint |
| Stripe — Stripe Checkout and BillingTaking payment for a paid plan. | United States, and onward "on a global basis" |
| Resend — ResendSending transactional email — confirmations, password resets, notifications. | United States |
Reporting a vulnerability
If you believe you have found a security vulnerability in Vivid Risk, please email security@vividrisk.ai.
Please include
- What you found, and where (the page, route or feature).
- The steps to reproduce it.
- What an attacker could do with it, as far as you know.
- How to reach you.
While testing, please
- Do not access, change or delete data that is not yours, and stop as soon as you reach anyone else's.
- Do not degrade the service for other people: no denial-of-service testing, spam or social engineering of our staff or customers.
- Give us a reasonable time to fix the issue before you disclose it publicly.
We do not run a paid bug bounty programme. This policy is also published at /.well-known/security.txt.
Vivid Risk LTD, company registration number 818204. See also the Data Processing Agreement and the Privacy Policy.