Security questionnaires, procurement, IT sign-off — 21RISK ships the certifications and controls large industrial companies expect, and answers the questions the same day.
"21RISK provides comfort to our management and to senior leadership — it creates transparency."
less time collecting and analysing risk data — Nilfisk's estimate, measured across a global site portfolio.
When procurement sends the questionnaire, the answers exist: certified controls, recurring outside testing, and the documents to prove it.
Security, availability, confidentiality, privacy and processing integrity, audited over time — report and attestation letter available on request.
Recurring vulnerability assessments and penetration tests, plus continuous security-header and vulnerability scans.
The security overview, sub-processors, DPA and SLA are on the website. Enterprise customers download SOC 2 reports and test results in the app.
People sign in with the accounts they already have, get exactly the access their role needs, and lose it the day they leave.
SAML and OIDC, with step-by-step setup guides for Microsoft Entra and Google Workspace.
Users sync automatically from Entra — onboarding and offboarding included.
Roles and granular permissions down to single sites and boards — third-party auditors see exactly what you invite them to.
Every answer, action and edit is versioned. When the auditor asks what changed since last year, you already know.
Per board, per site and per user: every permission someone holds, and the group, role or assignment it comes from.
Give 21RISK the federation metadata URL from Microsoft Entra and it picks up new signing certificates several times a day.
New boards, owner changes, site edits and logins land in one activity log — owners subscribe by email to the events they care about.
One sites foundation for the whole group — insurance and safety workflows hang off the same master data.
ROLLOUTSimple enough that sites actually use it. No six-month implementation project, no consultants required.
Hosting, sub-processors, the DPA and the SLA are public documents, so legal and IT can read them before the first call.
The production database runs in AWS eu-central-1, encrypted at rest and over TLS in transit.
BACKUPSFull backups across regions, file backups to a separate store and a written disaster recovery plan.
GDPRThe data processing agreement is part of the customer terms — no transfers outside the EU/EEA without your written consent.
SUB-PROCESSORSName, purpose, country and certification for the sub-processors that host and run 21RISK.
SLAIf monthly availability drops below 99.1%, the SLA credits 10–50% of that month’s fees.
AIAI chat runs with the asking user’s permissions, is enabled per organisation and per user, and has spend caps.
Your analytics team connects Power BI straight to Postgres. Brokers pull current values via API. Your AI assistants query risk data through our MCP server.
The production database runs in AWS eu-central-1 in Frankfurt, encrypted at rest and over TLS in transit, with full backups kept in a second region. The public sub-processors page lists the third parties that host and run the platform, with their country and certifications; the AI security model covers the AI gateway and model providers.
Yes. We share the SOC 2 Type 2 report and attestation letter on request during procurement. Enterprise customers download the latest reports and penetration test results themselves under Settings › Compliance in the app.
A GDPR data processing agreement is part of the customer terms, so it applies from day one. It rules out transfers outside the EU/EEA without your written consent. If you sign a master agreement with 21RISK, the DPA becomes part of that agreement instead.
Single sign-on works over SAML or OIDC, with step-by-step guides for Microsoft Entra and Google Workspace and a generic SAML guide for other providers. SCIM provisioning from Microsoft Entra creates, updates and deactivates users; group memberships and permissions are still managed in 21RISK.
Only what a request needs: the conversation, a short system prompt and, when the assistant looks something up, the result of that lookup. It runs with the asking user’s own permissions, so it cannot read anything that user could not. AI is switched on per organisation and per user, with monthly spend limits, and the full AI security model is public.
Send it to security@21risk.com. Most answers already exist in the public security documentation, and we answer the rest directly.
Talk to us about your sites, your values and your security review — we'll bring the answers.