# Risk Register — Acme Inc

> Auto-generated by Codepliant on 2026-03-19.
> This register catalogs compliance risks identified from code analysis.
> Review with legal and security teams before relying on this for risk management.
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## Executive Summary

| Risk Level | Count |
|------------|-------|
| 🔴 Critical | 3 |
| 🟠 High | 3 |
| 🟡 Medium | 2 |
| **Total** | **8** |

## Risk Scoring Matrix

Risk Score = Likelihood × Impact (1–5 each, max 25)

| Score Range | Level | Action Required |
|-------------|-------|-----------------|
| 15–25 | 🔴 Critical | Immediate remediation required |
| 10–14 | 🟠 High | Address within 30 days |
| 5–9 | 🟡 Medium | Address within 90 days |
| 1–4 | 🟢 Low | Monitor and review quarterly |

## Risk Register

| ID | Risk | Category | Likelihood | Impact | Score | Level |
|----|------|----------|------------|--------|-------|-------|
| RISK-004 | Invalid consent for tracking | consent | 4 (Likely) | 4 (Major) | 16 | 🔴 Critical |
| RISK-001 | User credentials data breach | data-breach | 3 (Possible) | 5 (Critical) | 15 | 🔴 Critical |
| RISK-008 | Missing required compliance documents | regulatory | 5 (Almost Certain) | 3 (Moderate) | 15 | 🔴 Critical |
| RISK-005 | AI data leakage | ai-specific | 3 (Possible) | 4 (Major) | 12 | 🟠 High |
| RISK-006 | EU AI Act non-compliance | ai-specific | 3 (Possible) | 4 (Major) | 12 | 🟠 High |
| RISK-002 | Payment data exposure | data-breach | 2 (Unlikely) | 5 (Critical) | 10 | 🟠 High |
| RISK-003 | Third-party vendor data handling | vendor | 3 (Possible) | 3 (Moderate) | 9 | 🟡 Medium |
| RISK-007 | Unsolicited email communications | operational | 3 (Possible) | 3 (Moderate) | 9 | 🟡 Medium |

## Risk Details

### RISK-004: Invalid consent for tracking 🔴

**Category:** consent  
**Likelihood:** 4/5 (Likely)  
**Impact:** 4/5 (Major)  
**Risk Score:** 16/25 (Critical)  

**Description:** Analytics and advertising services may collect data before obtaining valid user consent, violating GDPR/ePrivacy requirements.

**Related Services:** posthog

**Mitigations:**

- [ ] Implement a consent management platform (CMP)
- [ ] Block tracking scripts until consent is obtained
- [ ] Document and audit consent flows regularly
- [ ] Provide granular consent options (not just accept/reject)
- [ ] Implement consent withdrawal mechanisms

### RISK-001: User credentials data breach 🔴

**Category:** data-breach  
**Likelihood:** 3/5 (Possible)  
**Impact:** 5/5 (Critical)  
**Risk Score:** 15/25 (Critical)  

**Description:** Authentication or database services store user credentials. A breach could expose passwords, tokens, or personal data.

**Related Services:** @supabase/supabase-js, prisma

**Mitigations:**

- [ ] Implement encryption at rest for all stored credentials
- [ ] Enable multi-factor authentication
- [ ] Conduct regular penetration testing
- [ ] Maintain an incident response plan
- [ ] Implement rate limiting and account lockout policies

### RISK-008: Missing required compliance documents 🔴

**Category:** regulatory  
**Likelihood:** 5/5 (Almost Certain)  
**Impact:** 3/5 (Moderate)  
**Risk Score:** 15/25 (Critical)  

**Description:** 3 required compliance document(s) identified but not yet generated: Privacy Policy, AI Disclosure, Cookie Policy.

**Mitigations:**

- [ ] Run 'codepliant go' to generate required documents
- [ ] Review and customize generated documents with legal counsel
- [ ] Publish required documents on your website
- [ ] Set up regular compliance document reviews (quarterly)

### RISK-005: AI data leakage 🟠

**Category:** ai-specific  
**Likelihood:** 3/5 (Possible)  
**Impact:** 4/5 (Major)  
**Risk Score:** 12/25 (High)  

**Description:** AI services may process user data through external APIs. Data sent to AI models could be used for training or exposed through model outputs.

**Related Services:** openai

**Mitigations:**

- [ ] Review AI provider data processing terms and opt out of training
- [ ] Implement input sanitization before sending data to AI APIs
- [ ] Log all data sent to and received from AI services
- [ ] Implement PII detection and redaction before AI processing
- [ ] Disclose AI usage in privacy policy and terms of service

### RISK-006: EU AI Act non-compliance 🟠

**Category:** ai-specific  
**Likelihood:** 3/5 (Possible)  
**Impact:** 4/5 (Major)  
**Risk Score:** 12/25 (High)  

**Description:** AI systems may fall under EU AI Act requirements. High-risk AI systems require conformity assessments, registration, and ongoing monitoring.

**Related Services:** openai

**Mitigations:**

- [ ] Classify AI systems by risk level (minimal/limited/high/unacceptable)
- [ ] Document AI system purpose, capabilities, and limitations
- [ ] Implement human oversight mechanisms for high-risk AI
- [ ] Maintain technical documentation per AI Act Article 11
- [ ] Register high-risk AI systems in the EU database

### RISK-002: Payment data exposure 🟠

**Category:** data-breach  
**Likelihood:** 2/5 (Unlikely)  
**Impact:** 5/5 (Critical)  
**Risk Score:** 10/25 (High)  

**Description:** Payment processing services handle sensitive financial data. PCI DSS compliance failures could lead to fines and data exposure.

**Related Services:** stripe, stripe-ios

**Mitigations:**

- [ ] Verify PCI DSS compliance of all payment processors
- [ ] Never store raw card numbers — use tokenization
- [ ] Implement PCI DSS SAQ-A or SAQ-A-EP controls
- [ ] Conduct annual PCI compliance audits
- [ ] Use payment processor hosted payment pages where possible

### RISK-003: Third-party vendor data handling 🟡

**Category:** vendor  
**Likelihood:** 3/5 (Possible)  
**Impact:** 3/5 (Moderate)  
**Risk Score:** 9/25 (Medium)  

**Description:** 8 third-party services detected. Each vendor introduces potential data handling, availability, and compliance risks.

**Related Services:** @sentry/node, @supabase/supabase-js, openai, posthog, prisma, resend, stripe, stripe-ios

**Mitigations:**

- [ ] Execute Data Processing Agreements (DPAs) with all vendors
- [ ] Conduct annual vendor security assessments
- [ ] Maintain a sub-processor list and notify users of changes
- [ ] Implement vendor exit strategies and data portability plans
- [ ] Monitor vendor security posture and incident reports

### RISK-007: Unsolicited email communications 🟡

**Category:** operational  
**Likelihood:** 3/5 (Possible)  
**Impact:** 3/5 (Moderate)  
**Risk Score:** 9/25 (Medium)  

**Description:** Email services may be used to send marketing communications without proper consent, violating CAN-SPAM, GDPR, or CASL.

**Related Services:** resend

**Mitigations:**

- [ ] Implement double opt-in for marketing emails
- [ ] Include working unsubscribe links in all marketing emails
- [ ] Maintain suppression lists and honor unsubscribe requests promptly
- [ ] Separate transactional and marketing email flows
- [ ] Document lawful basis for each email communication type

## Related Documents

- Privacy Impact Assessment (`PRIVACY_IMPACT_ASSESSMENT.md`)
- Third-Party Risk Assessment (`THIRD_PARTY_RISK_ASSESSMENT.md`)
- Information Security Policy (`INFORMATION_SECURITY_POLICY.md`)

---

*This risk register is generated from automated code analysis and should be reviewed by qualified legal and security professionals. It does not constitute legal advice.*
