Two different security boundaries
Public Security Review works without an account. Its active architecture, conversation and hypothetical plan are held in browser memory. Approved analysis requests pass through NetRisk’s hosted server to OpenAI. A guest review is not automatically saved to an organization workspace.
Organization workspaces use authenticated accounts and server-side access checks for their enabled vendor, questionnaire, assessment and evidence features. Signing in or using a company email does not transfer a guest review into that organization.
Reviews started inside the signed-in portal use the same v5 assessment interface. Accepted assessments, approved conversation, selected hypothetical controls and map layout are saved in Supabase for that account and workspace. The portal checks both ownership and workspace on every load, save and delete; these private reviews are not shared with other workspace members through the review feature.
Before information leaves your browser
Guest descriptions are checked for likely sensitive information locally before sending. Supported document extraction also happens locally; the extracted text is reviewed before submission. Follow-up messages use the review’s approval flow and can include relevant previously accepted context.
Credential-pattern masking is also applied at the public AI endpoint. These checks reduce accidental disclosure; they are not a complete data-loss prevention system or a guarantee of anonymization. Remove unnecessary personal data, passwords, keys and confidential details yourself.
Application and API protections
The public review implements the following controls. Their presence does not establish that every attack or deployment configuration has been independently tested.
- Server-only AI credentials; browser requests go through NetRisk rather than receiving the provider key.
- Same-origin checks, content-type checks, bounded request bodies and structured request validation for public AI calls.
- Graph and assessment reference checks before applying a model result; invalid responses produce an error rather than an invented successful assessment.
- Process-level request and concurrency limits, provider timeouts and bounded retries. These limits are not a distributed organization quota or a promise of protection against all abuse.
- Review-page Content Security Policy and framing restrictions, plus private/no-store responses for the review and AI endpoint. These headers do not erase provider logs or exported files.
Transport, storage and access
The public service is delivered over HTTPS. Hosting, workspace database and private object storage are provided by the services listed in the Subprocessors register. Storage encryption, backup handling and infrastructure access depend on those services and the applicable deployment configuration.
NetRisk servers and the requested AI provider process approved content in readable form to perform analysis. This is not end-to-end encryption that prevents the service providers from processing the content. No customer-managed encryption key or EU-only processing commitment is made by this page.
Use authorized workspace accounts and protect downloaded reports. Access controls and private storage do not make an intentionally shared export private again or establish that a workspace has passed a tenant-isolation audit.
AI, attack paths and proposed changes
Model output, supplied documents and retrieved pages can be wrong or contain hostile instructions. NetRisk treats them as untrusted input, constrains outputs and validates structure. Prompt-injection controls reduce risk but cannot guarantee correct or safe conclusions.
Architecture edits change the review model. Attack-path playback illustrates a modeled route; it does not exploit a system. Selecting a proposed control or playing a scenario does not configure your firewall, patch a device or prove that a control works. Validate and implement real changes through your own authorized processes.
Diagnostics and incident reporting
Public review diagnostics use an allowlist of request IDs, revision, model, stage, timing, token counts and error categories. The application’s diagnostic logger is designed to exclude prompt and response text. Hosting and other providers can still process request metadata and their own operational or security logs.
Report a suspected incident or vulnerability to security@netrisk.io. Include the affected feature, time and a non-sensitive request ID if available; do not email passwords or live customer evidence. We assess credible reports by impact and exploitability. Where notification duties apply, assessment and notification must follow the applicable legal and contractual requirements; beta status does not remove them.
Assurance and regulatory boundaries
This page describes implemented safeguards and their limits. It is not a penetration-test report, security certification, recovery guarantee or service-level agreement. NetRisk does not claim SOC 2, ISO 27001, PCI DSS or HIPAA assurance through these pages.
A risk-method selection, ATT&CK mapping, or reference to GDPR, NIS2, DORA or the EU AI Act does not establish regulatory compliance. Deployment-specific contracts, risk assessments, access reviews, retention schedules and transfer arrangements need separate verification.
Questions about this page?
Contact NetRisk at security@netrisk.io or contact the team.