Security

JRC RegRisk develops digital identity, financial-crime compliance and regulatory-intelligence solutions for institutional and professional use. Security, confidentiality and controlled access are core design and operational considerations. Safeguards are applied proportionately to the relevant system, data and risk.

Depending on the relevant environment and service, measures may include:

• controlled and role-based access, least-privilege principles and invitation-based access for sensitive administrative environments;
• authentication controls and separation of administrative/client access where appropriate;
• encryption in transit and controlled management of application secrets and credentials;
• server-side access controls, logging and auditability for sensitive operations;
• multi-tenant and data-isolation controls where applicable to the service architecture;
• secure development, dependency management, vulnerability remediation and change-control practices appropriate to the service;
• monitoring and review of security events and suspicious activity;
• contractual confidentiality and data-protection obligations for personnel and relevant service providers.

A certification, audit, assurance report or formal security standard applies only where JRC RegRisk expressly identifies it as current and applicable to the relevant service. Nothing on this page should be interpreted as a claim that JRC RegRisk holds ISO 27001, SOC 2, PCI DSS or another certification unless JRC RegRisk expressly states and can evidence that certification.

Customers and authorised users are responsible for protecting credentials, limiting privileges, maintaining secure devices and networks, promptly removing unnecessary access, following applicable data-minimisation requirements and using JRC RegRisk systems only for authorised purposes.

Unless expressly approved in writing, demos and evaluation/Sandbox environments should be used with synthetic, sample or appropriately anonymised data. Production identity documents, biometric data and other highly sensitive personal data should not be uploaded to a test environment merely for convenience.

If you believe you have identified a security vulnerability affecting a JRC RegRisk public website or service, email info@jrcregrisk.com with the subject “Security Report” and provide sufficient detail to reproduce the issue without including unnecessary personal data.

Without prior written authorisation, you must not access or modify another user's data, conduct denial-of-service activity, social engineering, destructive testing, automated high-volume scanning or any activity likely to degrade a service or violate applicable law.

No information system can be made completely secure. Security controls reduce risk but do not eliminate it. This Security page is informational and does not create service-level commitments, warranties or contractual security obligations beyond those expressly agreed in a signed contract.

Institutional customers may receive additional security, privacy, data-residency, incident-response or processing commitments through an applicable MSA, SOW, DPA or other signed agreement. Those signed terms prevail over this public page for the contracted service.