RiskBack helps businesses manage risk in agent commerce. Protecting the information and access involved in those workflows is part of that responsibility. RiskBack is operated by FullBricks LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.
This overview explains our approach and the responsibilities shared with customers. Deployment-specific controls and commitments belong in the applicable service agreement and Data Processing Addendum.
1. Account and organization access
Access to the signed-in dashboard requires authentication. Organization membership and role permissions govern access to organization features, including member administration and billing. Customers are responsible for inviting the right people, assigning appropriate roles and removing access when it is no longer needed.
Keep account credentials and integration secrets private. If you suspect an account or integration has been compromised, contact us promptly and revoke affected access through the relevant provider where available.
2. Customer data and confidentiality
The information RiskBack processes depends on the products enabled. It may include business contacts, order and payment references, agent activity, risk assessments, dispute records and service diagnostics. Our Privacy Policy describes these categories and their purposes.
We use technical and organizational safeguards designed to protect information against unauthorized access, loss, misuse and disclosure. Where we process personal data on your behalf, the applicable DPA sets out instructions, confidentiality, provider access and assistance obligations.
Send only information relevant to the agreed service. Ordinary contact and demo forms are intended for business inquiries. Use an agreed secure channel for sensitive records, credentials or incident evidence.
3. Integration permissions
Connect only systems your business is authorized to use. The permissions, data and actions available to RiskBack depend on your integration, configuration and the connected provider's controls.
Review the access you grant, protect credentials and update or revoke connections when your requirements change. Changes to a provider's permissions, availability or interface can affect a workflow. Your service agreement defines any specific operational or support commitments.
4. Providers, processing locations and retention
Service providers may support hosting, storage, communications, billing, monitoring, support and AI processing for enabled features. Access to customer-controlled personal data is subject to the relevant processing terms. The DPA explains subprocessor authorization and applicable transfer requirements.
Hosting locations, retention arrangements and provider restrictions should be confirmed for the service you select. Retention takes account of customer instructions, transaction and dispute lifecycles, legal duties and outstanding claims. Our AI Transparency page explains the role of automated analysis and the restrictions governing data use.
5. Security incidents
We investigate reported security issues and take steps appropriate to the circumstances. Where a personal-data breach affects information we process on your behalf, the applicable DPA governs notification and cooperation. Other incident notices follow the relevant agreement and law.
If you report an issue, include the affected service, approximate time, potential impact and a way to contact you. Do not include passwords, API keys or unnecessary personal information. We can arrange an appropriate channel for further evidence.
6. Security reviews
Use our contact page to request information for a security or procurement review. Tell us the products, integrations, markets and data categories involved so the review addresses the proposed deployment.
Specific requirements for encryption, access management, hosting, retention, audit evidence or compliance must be confirmed in the applicable documentation and agreement. This public overview does not represent an independent audit, certification or service-level commitment.
7. Reporting a vulnerability or asking a question
Use RiskBack's contact page and identify your message as a security report or security review request. Share a concise description first. Obtain authorization before testing systems, and avoid accessing another customer's information or disrupting a service.
You may also write to:
FullBricks LLC Attn: RiskBack Security 30 N Gould St Ste N Sheridan, WY 82801, USA