Security and data
Risk Core protects data by mechanism: each company’s data kept separate, rules enforced in the data layer, encryption, a second sign-in factor and history that cannot be rewritten.
Separation
Section titled “Separation”- Each company’s data kept separate. Row-level security in the database keeps a company’s data apart from every other company’s, including other companies of the same group. A separate database per company on request.
- Group consolidation by report-up only. A parent receives what each subsidiary has validated or approved, and has no access to the subsidiary’s records.
- One sign-in page through each client’s own domain. Staff reach Risk Core at their own company’s address and land in their own company’s data.
Rules in the data layer
Section titled “Rules in the data layer”- Row-level security in the database. Within a company, visibility and permission rules are enforced in the data layer, not only in the interface. A screen hides what a role cannot do, and the database refuses it regardless.
- Every report view runs with the caller’s own rights, so a dashboard or export never shows more than the person reading it may see.
- The rules themselves are set out in Product rules and Roles and permissions.
Protection
Section titled “Protection”- Encrypted in transit and at rest, on managed cloud infrastructure (PostgreSQL). The database is hosted in Singapore (AWS ap-southeast-1).
- MFA for everyone: a password plus a 6-digit authenticator code (TOTP); Remember this device for the number of days the client sets; Microsoft or Google SSO as a client option. See Signing in and Single sign-on and sign-in policy.
- Append-only history for valuations, submissions and the audit log.
- Audit log of every change in both modules: who, when, before and after, and which entity.
Your data
Section titled “Your data”- Data ownership. The client’s data belongs to the client.
- Export on request, and deletion at contract end.
- The public CSR path collects no personal data.
- PDPA. Qirin X acts as data processor for the personal data held in the service, under a Data Processing Agreement that is part of the service contract.