Where the data actually sits

Written against the running infrastructure, not against an intention. Where the posture falls short of EU residency, it says so.

Region: not EU, and that matters

The application layer is served from Cloudflare edge network, request served from the nearest point of presence. Requests from Europe terminate at European points of presence, but the origin data store is the fact that counts, and it is in Canada.

Several reasoning and search vendors process in the United States. Those transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses, and the register lists which agreements are actually in place and which are still outstanding.

Encryption

• In transit: TLS 1.2 or better on every connection, including calls out to model and search vendors.
• At rest: AES-256 volume encryption on the database and on file storage, managed by the platform.
• Secrets and API keys live in an encrypted secret store, injected at call time, never written into the codebase or the client bundle.

Access control

Every table carries row-level security, and the default is denial. A 4Sight, its dossier, its intake files and its report are readable only by the account that created them. There is no shared workspace read, no organisation-wide default, and no ambient admin read of report content.

• Ownership is enforced in the database itself, not in the interface. Calling the API directly with another account's identifier returns nothing.
• Privileged routines run as security-definer functions with execution revoked from anonymous and ordinary authenticated roles.
• Share links are opt-in, single-token, revocable, and can carry a password. Revoking one kills it immediately.
• Administrative roles live in a separate table, never on the profile, so a compromised profile row cannot grant itself privilege.
• The authorisation boundary was pen-tested against object-level access, and the findings were fixed at root and retested.

Retention, enforced

These windows are not a statement of intent. A scheduled sweep deletes past them, and the sweep reports what it removed.

Cookies and analytics

There is no analytics product, no advertising pixel and no third-party tracker on this site. The only browser storage 4Sight writes is the session token that keeps you signed in, which is strictly necessary for a service you asked for and therefore needs no consent banner. Clearing it signs you out.

If something goes wrong

On confirming a personal-data breach, Rizz Group notifies the Latvian Data State Inspectorate within 72 hours where the breach is likely to present a risk, and notifies affected people directly without undue delay where the risk is high. The notice states what happened, what data was involved, what we have done, and what you should do. Report a suspected weakness to engine@vetted.rizzgroup.org. Good-faith reports will not be pursued.

Known gaps

• The data store is in Canada, not the EU. Migration is an open item.
• Several vendor data processing agreements are not yet countersigned; the register marks each one.
• No independent security certification has been obtained. Nothing here claims SOC 2 or ISO 27001.
• No formal data protection impact assessment has been completed for the vetting of third parties.

Last reviewed 2026-08-23 · Rizz Group, Latvia · engine@vetted.rizzgroup.org