Security and trust
The decisions you record in RiskFlag matter, so we treat the data behind them with the same care. Here is how we protect it.
ISO 27001 for information security and ISO 9001 for quality, certified by BSI. Cyber Essentials Plus, renewed every year.
An independent penetration test of the platform every year, with findings tracked to closure.
Single sign-on with Microsoft or Google, two-factor authentication, and access removed centrally when someone leaves.
Roles, teams and tag-based permissions decide who can see and change each case, register and document.
Every change is in the activity log: who changed what, when, and what it was before.
Encrypted storage, frequent backups copied to a second location, and round-the-clock monitoring. Service status is published at status.riskflag.com.
AI and your data
RiskFlag AI is off unless your organisation chooses to switch it on. With RiskFlag-managed AI, processing takes place in the UK and EU and your data is not used to train AI models. Alternatively, connect your own AI provider under your own agreement. The assistant always works within each person’s permissions and changes nothing without their approval.
Your own installation
Where policy requires it, RiskFlag can be installed on your own infrastructure, at additional cost. Talk to us about your requirements.
Security FAQs
Yes. Contact us and we will share our ISO 27001, ISO 9001 and Cyber Essentials Plus certificates and a summary of our latest penetration test.
Yes. You can export your data and audit records at any time during your contract, and all evidence can be exported in a single ZIP file.
Yes, with Microsoft and Google accounts, matched to your organisation by email domain. Two-factor authentication is available for everyone else.