> Auto-generated by Codepliant on 2026-03-19. This register catalogs compliance risks identified from code analysis. Review with legal and security teams before relying on this for risk management. Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Executive Summary

Risk Level | Count
--- | ---
🔴 Critical | 3
🟠 High | 3
🟡 Medium | 2
Total | 8

## Risk Scoring Matrix

Risk Score = Likelihood × Impact (1–5 each, max 25)

Score Range | Level | Action Required
--- | --- | ---
15–25 | 🔴 Critical | Immediate remediation required
10–14 | 🟠 High | Address within 30 days
5–9 | 🟡 Medium | Address within 90 days
1–4 | 🟢 Low | Monitor and review quarterly

## Risk Register

ID | Risk | Category | Likelihood | Impact | Score | Level
--- | --- | --- | --- | --- | --- | ---
RISK-004 | Invalid consent for tracking | consent | 4 (Likely) | 4 (Major) | 16 | 🔴 Critical
RISK-001 | User credentials data breach | data-breach | 3 (Possible) | 5 (Critical) | 15 | 🔴 Critical
RISK-008 | Missing required compliance documents | regulatory | 5 (Almost Certain) | 3 (Moderate) | 15 | 🔴 Critical
RISK-005 | AI data leakage | ai-specific | 3 (Possible) | 4 (Major) | 12 | 🟠 High
RISK-006 | EU AI Act non-compliance | ai-specific | 3 (Possible) | 4 (Major) | 12 | 🟠 High
RISK-002 | Payment data exposure | data-breach | 2 (Unlikely) | 5 (Critical) | 10 | 🟠 High
RISK-003 | Third-party vendor data handling | vendor | 3 (Possible) | 3 (Moderate) | 9 | 🟡 Medium
RISK-007 | Unsolicited email communications | operational | 3 (Possible) | 3 (Moderate) | 9 | 🟡 Medium

## Risk Details

### RISK-004: Invalid consent for tracking 🔴

Category: consent

Likelihood: 4/5 (Likely)

Impact: 4/5 (Major)

Risk Score: 16/25 (Critical)

Description: Analytics and advertising services may collect data before obtaining valid user consent, violating GDPR/ePrivacy requirements.

Related Services: posthog

Mitigations:

- Implement a consent management platform (CMP)
- Block tracking scripts until consent is obtained
- Document and audit consent flows regularly
- Provide granular consent options (not just accept/reject)
- Implement consent withdrawal mechanisms

### RISK-001: User credentials data breach 🔴

Category: data-breach

Likelihood: 3/5 (Possible)

Impact: 5/5 (Critical)

Risk Score: 15/25 (Critical)

Description: Authentication or database services store user credentials. A breach could expose passwords, tokens, or personal data.

Related Services: @supabase/supabase-js, prisma

Mitigations:

- Implement encryption at rest for all stored credentials
- Enable multi-factor authentication
- Conduct regular penetration testing
- Maintain an incident response plan
- Implement rate limiting and account lockout policies

### RISK-008: Missing required compliance documents 🔴

Category: regulatory

Likelihood: 5/5 (Almost Certain)

Impact: 3/5 (Moderate)

Risk Score: 15/25 (Critical)

Description: 3 required compliance document(s) identified but not yet generated: Privacy Policy, AI Disclosure, Cookie Policy.

Mitigations:

- Run 'codepliant go' to generate required documents
- Review and customize generated documents with legal counsel
- Publish required documents on your website
- Set up regular compliance document reviews (quarterly)

### RISK-005: AI data leakage 🟠

Category: ai-specific

Likelihood: 3/5 (Possible)

Impact: 4/5 (Major)

Risk Score: 12/25 (High)

Description: AI services may process user data through external APIs. Data sent to AI models could be used for training or exposed through model outputs.

Related Services: openai

Mitigations:

- Review AI provider data processing terms and opt out of training
- Implement input sanitization before sending data to AI APIs
- Log all data sent to and received from AI services
- Implement PII detection and redaction before AI processing
- Disclose AI usage in privacy policy and terms of service

### RISK-006: EU AI Act non-compliance 🟠

Category: ai-specific

Likelihood: 3/5 (Possible)

Impact: 4/5 (Major)

Risk Score: 12/25 (High)

Description: AI systems may fall under EU AI Act requirements. High-risk AI systems require conformity assessments, registration, and ongoing monitoring.

Related Services: openai

Mitigations:

- Classify AI systems by risk level (minimal/limited/high/unacceptable)
- Document AI system purpose, capabilities, and limitations
- Implement human oversight mechanisms for high-risk AI
- Maintain technical documentation per AI Act Article 11
- Register high-risk AI systems in the EU database

### RISK-002: Payment data exposure 🟠

Category: data-breach

Likelihood: 2/5 (Unlikely)

Impact: 5/5 (Critical)

Risk Score: 10/25 (High)

Description: Payment processing services handle sensitive financial data. PCI DSS compliance failures could lead to fines and data exposure.

Related Services: stripe, stripe-ios

Mitigations:

- Verify PCI DSS compliance of all payment processors
- Never store raw card numbers — use tokenization
- Implement PCI DSS SAQ-A or SAQ-A-EP controls
- Conduct annual PCI compliance audits
- Use payment processor hosted payment pages where possible

### RISK-003: Third-party vendor data handling 🟡

Category: vendor

Likelihood: 3/5 (Possible)

Impact: 3/5 (Moderate)

Risk Score: 9/25 (Medium)

Description: 8 third-party services detected. Each vendor introduces potential data handling, availability, and compliance risks.

Related Services: @sentry/node, @supabase/supabase-js, openai, posthog, prisma, resend, stripe, stripe-ios

Mitigations:

- Execute Data Processing Agreements (DPAs) with all vendors
- Conduct annual vendor security assessments
- Maintain a sub-processor list and notify users of changes
- Implement vendor exit strategies and data portability plans
- Monitor vendor security posture and incident reports

### RISK-007: Unsolicited email communications 🟡

Category: operational

Likelihood: 3/5 (Possible)

Impact: 3/5 (Moderate)

Risk Score: 9/25 (Medium)

Description: Email services may be used to send marketing communications without proper consent, violating CAN-SPAM, GDPR, or CASL.

Related Services: resend

Mitigations:

- Implement double opt-in for marketing emails
- Include working unsubscribe links in all marketing emails
- Maintain suppression lists and honor unsubscribe requests promptly
- Separate transactional and marketing email flows
- Document lawful basis for each email communication type

## Related Documents

- Privacy Impact Assessment (`PRIVACYIMPACTASSESSMENT.md`)
- Third-Party Risk Assessment (`THIRDPARTYRISK_ASSESSMENT.md`)
- Information Security Policy (`INFORMATIONSECURITYPOLICY.md`)

This risk register is generated from automated code analysis and should be reviewed by qualified legal and security professionals. It does not constitute legal advice.