Your risk register is your most sensitive document. We treat it as such.

Hosting

Application data (register, incidents, reports, accounts) is stored in a managed PostgreSQL database at Supabase, in Switzerland (AWS eu-central-2, Zurich). The contracting entity is Supabase Pte. Ltd, Singapore; for transfers out of Switzerland, its data processing agreement provides for the standard contractual clauses with their Swiss adaptations (art. 16 para. 2 let. d FADP).

The application is served by Vercel Inc., a company established in the United States. The pages of your workspace are computed by its server functions, set to the fra1 region, Frankfurt (Germany), which read your data in Zurich each time a page is displayed; Germany ensures an adequate level of protection (art. 16 para. 1 FADP, Annex 1 DPO). The session check that precedes each page runs in the Vercel region closest to the visitor. As Vercel Inc. is established in the United States, what it processes on our behalf is governed by its Data Processing Addendum (DPA), which applies to our Pro plan and provides Standard Contractual Clauses for data coming from Switzerland (art. 16 para. 2 let. d FADP). Hosting entirely in Switzerland, application layer included, remains under review for clients who require it.

Encryption

Exchanges with the site go over HTTPS, which the HSTS header enforces in the browser for two years. According to Supabase's documentation, the database is encrypted at rest (AES-256) and passwords are stored there hashed (bcrypt), never in clear text.

Isolation by organisation

Each organisation can access only its own data. This isolation is enforced at database level (PostgreSQL Row Level Security), not only in the application: even in the event of an application defect, the database refuses to serve another organisation's data.

This design was hardened following internal security reviews: functions with a fixed search_path, uniqueness and length constraints in the database, cross-table consistency checks, server-side validation of inputs. No independent security audit has been carried out to date.

Backups

The database is backed up automatically every day by Supabase; each backup is kept for 7 days. Deleted data therefore also disappears from the backups within 7 days at the latest.

Access policy

Only the publisher administers the platform. He opens the content of your workspace (risks, incidents, reports, figures) only at your request, for support. His administration console, protected by authentication, shows for each organisation its name, sector, current period, dates of creation and last change and the number of items entered, and for each account its email address and dates of sign-up and last sign-in; never the content entered.

Data protection (FADP)

The processing of your data is governed by the Federal Act on Data Protection (FADP). For the content of your workspace, RiskBoard acts as your company's processor and processes it only to provide the service. For a pilot, the data processing agreement governing this processing is concluded with your company before any real data is entered. The register can be exported as CSV from the application. On request to contact@riskboard.ch, we export the other modules and delete all your data, free of charge; it then disappears from the backups within 7 days. For the data for which RiskBoard is itself the controller (your account, your exchanges with us), you may ask which data we process, and have it corrected or erased (art. 25 and 32 FADP).

The OHS module contains data about your employees' health: an occupational-disease incident, with its date and days lost, is such data as soon as the person can be recognised, which happens quickly in a small team, even without a name. This is sensitive personal data within the meaning of the FADP (art. 5 let. c no. 2). It stays in your workspace, under the same isolation as the rest, and the horizon-scanning analysis does not transmit it.

What the site records about you

Account. When you sign up, we record your email address and your password, stored hashed. At each sign-in, Supabase records the date, IP address and browser of the session opened. This data is used to authenticate you and secure access. It is kept as long as the account exists; to close it, write to contact@riskboard.ch.

Visits and cookies. On the public pages, our visit counter uses no cookie: it records the address of the page viewed with all its parameters (those of a campaign, for instance), the name of the site you came from and the time, without your IP address or your browser. Our host Vercel also records incoming requests in its technical logs. The only cookies the site sets are for signing in: they are set when you create your account or sign in, and otherwise the site sets none. You can delete them from your browser, which signs you out.

Booking a call. The “Request a 15-minute call” button opens a Google Calendar booking page. The name and email address you enter there are transmitted to Google, which operates this service.

Emails. Messages sent to contact@riskboard.ch and their attachments, including a pilot's Excel register, are kept in an Infomaniak mailbox; according to Infomaniak, this data is hosted exclusively in Switzerland.

Prospecting. We write to managers of Swiss companies whose names appear in public sources (Swiss Official Gazette of Commerce, professional registers, directories, company websites); each message states where the name comes from. The email address comes from the company's website or from a business contact database. To stop being contacted, write to contact@riskboard.ch.

AI analysis in horizon scanning

The Horizon scanning page proposes a selection of emerging risks tailored to your organisation. To establish it, we transmit to Anthropic the name of your organisation, its sector, and the list of the risks in your register (code, title, category). Our contracting party is Anthropic Ireland, Limited, in Ireland; the request data is stored in the United States, and the computation may run in any region chosen by Anthropic. Risk details (description, causes, controls, owner), action plans, OHS incidents and financial figures are not transmitted. Titles are sent as you entered them: a person's name written in a title is transmitted with it.

This transfer takes place only when you launch the analysis, never in the background. Anthropic's commercial terms prohibit it from training its models on data received through its API. Ireland ensures an adequate level of protection (art. 16 para. 1 FADP, Annex 1 DPO); beyond that, Anthropic's data processing agreement incorporates the European Commission's standard contractual clauses and their Swiss addendum (art. 16 para. 2 let. d FADP).

What we do not do

No sale of data. The content of your workspace is not transmitted to any recipient other than the providers named on this page. RiskBoard trains no AI model on your data. Not one sentence of your reports is written by an AI: all figures are calculated, traceable and reproducible. The only exception is horizon scanning, whose comments are generated and flagged as such in the interface (see above).