Data and security

RiskCurb is calm about security, on purpose. This page states plainly how data is stored and how access is enforced, without alarm.

Where your data lives

Workspace data is stored in a managed Postgres database, isolated per deployment. Content such as documentation and this site's marketing pages is managed separately from workspace data. Your register, controls, claims, and members live in the database for your workspace only.

How access is enforced

Access control is enforced at the database layer, not only in the interface. Every query runs under the requesting user's identity, and row-level rules check workspace membership and role before any data is returned. A member of one agency's workspace cannot read another's data, and a removed member loses access immediately.

Interface-level permissions are convenience. The database rules are the enforcement.

What AI processing touches

AI-assisted review drafts summaries, suggests classifications, and surfaces signals from your register data. Outputs are drafts until a human approves them, as described in AI-assisted review.

Operational practices

• Members authenticate with email and password or single sign-on where configured.
• Password reset and session revocation follow standard account recovery flows.
• Workspace owners manage membership, and departures take effect immediately.

Reporting a concern

If you believe you have found a security issue, contact the RiskCurb team directly through the contact page. Please do not test suspected issues against production workspaces.

For security commitments in contract language, see the security page on the marketing site or ask during your demo conversation.