This is a living document. Risks are reviewed quarterly and updated as the platform evolves. This register is made available to institutional clients and investors as part of our transparency commitment.
4
HIGH RISKS
7
MEDIUM RISKS
3
LOW RISKS
1. Data & Privacy Risks
| ID | Risk | Likelihood | Impact | Inherent Risk | Mitigation | Status |
|---|---|---|---|---|---|---|
| DP-01 | Personal data breach — unauthorised access to collector vault data | Medium | High | HIGH | HTTPS encryption, access controls, planned audit logging and MFA rollout | In Progress |
| DP-02 | Non-compliance with UK GDPR — failure to register with ICO | Low | High | MEDIUM | ICO registration in progress. Privacy Policy and T&Cs published. Data retention policy in place. | In Progress |
| DP-03 | AI service processes more personal data than necessary | Low | Medium | MEDIUM | AI data minimisation policy enforced — no personal identifiers sent to AI APIs. Reviewed at each AI integration. | Mitigated |
| DP-04 | Collector shares vault access with unauthorised third party | Low | Medium | LOW | Scoped permission levels, full audit trail, revocation at any time. User education on responsible sharing. | Mitigated |
2. Infrastructure & Technical Risks
| ID | Risk | Likelihood | Impact | Inherent Risk | Mitigation | Status |
|---|---|---|---|---|---|---|
| IT-01 | API hosting downtime — Render.com free tier spins down after inactivity | High | Medium | MEDIUM | Upgrade to paid Render tier or migrate to AWS before launch. Fallback to sample data on frontend. | Open |
| IT-02 | Database stored as flat JSON file — data loss risk on server reset | Medium | High | HIGH | Migrate to PostgreSQL (Supabase or AWS RDS) before real user launch. Daily backup policy to be implemented. | Open |
| IT-03 | API key exposure — Anthropic API key in environment variables | Low | High | MEDIUM | Keys stored in server environment only, never in code. Key rotation procedure documented. Git history reviewed. | In Progress |
| IT-04 | No rate limiting on API — potential for abuse or cost escalation | Medium | Medium | MEDIUM | express-rate-limit middleware implemented across public-facing endpoints and confirmed working. Anthropic API usage monitored via console dashboard. | Mitigated |
3. Legal & Regulatory Risks
| ID | Risk | Likelihood | Impact | Inherent Risk | Mitigation | Status |
|---|---|---|---|---|---|---|
| LR-01 | Platform perceived as providing financial or insurance advice without authorisation | Medium | High | HIGH | All AI outputs clearly marked as informational only. Disclaimers on every analysis. T&Cs explicitly exclude advice liability. FCA status review planned. | In Progress |
| LR-02 | Stolen asset register — liability if inaccurate or abused | Low | High | MEDIUM | Clear disclaimers: register is not the Police National Computer. Crime reference number required. T&Cs exclude liability for register inaccuracies. | Mitigated |
| LR-03 | No incorporated legal entity — personal liability exposure | High | High | HIGH | Incorporate as Ltd company before accepting any paid subscriptions or real user data. Currently demo-only. | Open |
4. Operational & Business Risks
| ID | Risk | Likelihood | Impact | Inherent Risk | Mitigation | Status |
|---|---|---|---|---|---|---|
| OP-01 | Key person dependency — platform knowledge concentrated in one person | High | High | MEDIUM | Document all processes. Platform code on GitHub. Recruit technical co-founder or senior developer before launch. | Open |
| OP-02 | Anthropic API cost escalation at scale | Medium | Medium | LOW | Monitor usage via Anthropic console. Cache AI responses where appropriate. Build cost model into pricing tiers. | In Progress |
| OP-03 | Market data inaccuracies — watch/precious metal prices not from live certified source | High | Low | LOW | All non-live data clearly labelled "indicative" or "estimated". Disclaimer on all market data. Plan to integrate certified data sources at scale. | Mitigated |