Your GRC data, held to your standard.
A dedicated environment for each customer, encryption at rest, a tamper-evident audit log, deny-by-default APIs and data classification that keeps Restricted content away from AI.
| Time | Actor | Action |
|---|---|---|
| 10:42 | AI · Policy review | Reviewed Access Policy vs ISO 27001 |
| 10:38 | J. Mehta | Approved exception R-1031 |
| 10:21 | AI · Assistant | Created finding F-318 (confirmed) |
| 09:57 | S. Ortiz | Mapped evidence E-904 |
| 09:40 | AI · Mapping | Proposed 12 control mappings |
Illustration with sample data
What Security, Privacy & Data Protection does
Each customer runs in a dedicated environment with its own application process, database, file store and encryption key, hosted on Microsoft Azure. Files are encrypted at rest, and the database is encrypted too. Every API route is deny-by-default and resolved against one permission registry when it is registered. Sessions use secure cookies with CSRF protection, absolute and idle timeouts, and re-verification by emailed code for sensitive actions. Login is throttled and accounts lock out after repeated failures.
The audit log is hash-chained and append-only, covers people, AI and system actions, and is verified hourly. Records can be classified Public, Internal, Confidential or Restricted, and Restricted content is never sent to an AI provider. Large exports need a dedicated permission and a reason, and they alert Admins. Data Retention purges operational data on schedule and never purges the audit log. A full encrypted Data Export of everything you own is available to Admins.
Key capabilities
Dedicated environment
Own process, database, file store and encryption key per customer.
Encryption at rest
Uploaded files and the database encrypted; keys rotate without data loss.
Tamper-evident audit
Hash-chained, append-only log of human, AI and system actions.
Deny by default
Every API route checked by one permission registry.
Data classification
Public to Restricted; Restricted content never reaches AI.
Export & retention
Encrypted full data export; configurable retention for operational data.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Security, Privacy & Data Protection changes for your programme.
No shared databases
Customer data never shares a database or process with another customer.
Integrity you can prove
Hash-chain verification shows the audit log hasn't been altered.
Full export
Take everything with you in a documented, checksummed package.
Including AI
AI actions are logged and traced like human ones.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Provision
A dedicated environment is created for your organisation.
Protect
Encryption, MFA, session controls and classification apply.
Monitor
Audit chain checks and security events run continuously.
Retain or export
Retention runs on schedule; export whenever you need.
Supports your obligations.
Security, Privacy & Data Protection contributes evidence and coverage to these frameworks and regulations.
Common questions.
Is our data in a shared database?
No. Each customer has a dedicated environment with its own database, application process, file store and encryption key.
Can anyone edit the audit log?
The application never updates or deletes audit entries. The log is hash-chained, and its integrity is verified hourly and on demand.
Does RiskVantis support staff see our records?
Support access is approved by your Admin, time-boxed and limited to diagnostic metadata. It never includes records, names or file contents, and every read is logged.
Works better together.
Identity, SSO & Access Governance
Single sign-on with your directory, MFA, and one permission engine for personas, deny rules, field-level security and segregation of duties. Access reviews, break-glass…
Learn more →AI & IntelligenceAI Governance, Models & Budgets
Every AI call in RiskVantis goes through one gateway. It applies your choice of provider and model, your zero-data-retention policy and your budgets, and it keeps…
Learn more →Platform, Security & IntegrationsNotifications, Workflow & Administration
One notification engine with rules per organisation, a template designer and digests. Workflow configuration is simulated before it changes anything, a setup wizard gets…
Learn more →See Security, Privacy & Data Protection in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.