Risk management
Risk management
A summary of how Preventa Health identifies, scores and mitigates risk to the platform and the data we process. The detailed risk register is maintained internally; this page describes the methodology and our top-level risk categories with current mitigations.
Maintained by Preventa Health. This page is editable content, not an independent certification.
Last reviewed: July 2026 · Reviewed at least quarterly
1. Methodology
- Each risk is scored on likelihood (1–5) and impact (1–5); residual risk is reviewed against tolerance.
- Risks are reviewed at least quarterly by leadership and engineering, and whenever a material change occurs (new sub-processor, new data class, new feature touching clinical data).
- Mitigation owners and review dates are tracked in the internal risk register.
2. Top-level risk categories
- Unauthorised access to clinical data. Mitigations: RLS on every public table, six-role RBAC, MFA for staff, edge-function re-validation of JWT and role, audit logging of privileged actions.
- Data loss or corruption. Mitigations: daily encrypted backups with point-in-time recovery, quarterly restore tabletop, annual full restore drill, migration-controlled schema changes.
- Sub-processor failure or compromise. Mitigations: documented sub-processor register, signed data processing agreements, annual review, EU-only data residency.
- Service availability disruption. Mitigations: provider-managed redundancy, observability and alerting, change-management process, rollback paths on schema and code changes.
- Malicious code or dependency compromise. Mitigations: automated dependency scanning, secrets scanning, peer-reviewed pull requests, vulnerability-management SLA (Critical 7d / High 30d / Medium 90d).
- Insider risk. Mitigations: least-privilege access, quarterly access reviews, append-only audit log, mandatory MFA, prompt off-boarding.
- Regulatory and clinical-standard change. Mitigations: clinical leadership ownership, alignment to NHG / ESC / WHO guidance, version-controlled clinical thresholds and references.
3. Risk acceptance and governance
Residual risk above tolerance is escalated to leadership for explicit acceptance or further mitigation. Accepted risks are documented with rationale and a review date. This page is the public summary; full register entries (including specific findings and owners) are confidential.