Question 1

How does Risk-3D compare to enterprise GRC platforms?

Accepted Answer

Risk-3D and enterprise GRC platforms solve different problems. GRC tools (Archer, ServiceNow GRC, MetricStream) are broad governance suites covering policy, risk, compliance, audit, and vendor management across the whole institution. Risk-3D goes deep on one thing: the RCSA-to-reconciliation-to-evidence loop that operational risk teams run every cycle. Most clients run Risk-3D alongside their existing GRC. Both models work, and both have their place.

Question 2

Where does our data sit, and how is it secured?

Accepted Answer

Data is hosted on Supabase (PostgreSQL) with row-level security ensuring strict tenant isolation between client institutions. The application runs on Cloudflare's global edge network. We can deploy to Singapore, Mumbai, or Frankfurt regions on request. All AI calls route through a Cloudflare Worker proxy, so client data is never exposed in browser-to-API traffic. Encrypted in transit and at rest, with AI inputs never used to train any model.

Question 3

What does implementation actually look like?

Accepted Answer

For a mid-sized institution: roughly 2 weeks from kickoff to first live RCSA cycle. Week 1 is workflow setup (departments, processes, taxonomy calibration, user accounts). Week 2 is policy upload, AI generation review, and 2LoD walkthrough. Cycle 1 runs in the third week with our team alongside yours. No 6-month rollout, no consultant army.

Question 4

Can our regulator audit the AI's work?

Accepted Answer

Yes, and the platform is designed for exactly that. Every AI-generated control is traceable to the policy paragraph that produced it. Every 2LoD challenge is logged with reviewer, timestamp, and rationale. Every cycle produces a signed, immutable record. The 9-Stage Process Integrity Lifecycle gives you a citable methodology when your supervisor asks how the assessment was constructed.

Question 5

Is the AI specific to our institution, or is it generic?

Accepted Answer

It is calibrated, not generic. The AI runs against a detailed BFSI process taxonomy spanning lending, payments, customer service, operations, collections, and supporting functions. When your team selects the workflow, the AI generates controls specific to that combination. A lending origination workflow at a regional bank produces different controls than a lending origination workflow at a digital lender, because the underlying process risks differ.

Question 6

What happens if we cancel?

Accepted Answer

You get a full export of all your data: RCSA rows, control libraries, reconciliation results, audit trail, all in machine-readable formats (Excel, CSV, JSON). No lock-in, no penalty, no proprietary format you cannot take elsewhere. We would rather you stay because the platform earns its keep, not because it is hard to leave.

Question 7

Does the AI make the risk decisions?

Accepted Answer

No. The AI proposes and surfaces. It drafts controls, flags weak evidence, links a loss to the control that should have caught it, and matches a regulation to the controls it touches. A person records the result and the second line signs off. The AI never approves a control on its own. It makes the gaps visible so your team can act on them.