Security & privacy
Useful evidence.
Careful boundaries.
Collect the context you need to review risk. Keep sensitive payment details out of the picture.
EU hosting
RiskCogs is designed for EU-hosted project data. Confirm the region, subprocessors and transfer arrangements in your onboarding documentation before enabling production capture.
Replay starts with consent
Replay capture must respect your consent policy. Sensitive fields are masked; configure exclusions before enabling capture. A risk score is a review signal, not proof of wrongdoing.
BIN context, not card numbers
Card context is limited to BIN metadata. Never send full card numbers, security codes, passwords or authentication secrets to the scoring or feedback API.
Erasure and retention
Request deletion of customer risk records and associated replay data. Your agreement defines retention, processing roles and any applicable exceptions. Send requests through your project support channel with the relevant record identifiers.
Data processing agreement
A DPA and security questionnaire are available on request. Review the final processing terms before production onboarding.
Request the DPA