What this site collects, and how to check.

Nothing on riskmandate.ai is measured, tracked or stored about you. There is no analytics, no tag manager, no advertising pixel and no cookie set by this site. That is a claim you do not have to take on trust: every page is plain HTML in a public repository, and your browser’s network tab is the audit.

What happens when you read a page ↓ What happens if you buy

Reading the site

No analytics, no cookies, and one thing in your browser.

The site is static files. It runs no server of its own, holds no database, and has no account to create.

What	Whether this site does it
Analytics, product analytics or a tag manager	None. No Google Analytics, no Plausible, no Segment, no pixel of any kind.
Cookies set by this site	None. Nothing on this site writes a cookie.
Browser storage	One key. The behaviour-policy pages remember how wide you dragged the side panel, under `rm-abp-panel-w`. It stays in your browser, it is a number, and clearing site data removes it.
Fonts and scripts from somebody else’s server	None. The typeface is served from this site, and every script is inline in the page it belongs to.
An account, a sign-up or a newsletter	None. There is nothing to create and no list to join.
Forms that post to a server	None. The one form on the site, on which behaviour policy next, opens your own mail client with the text in it. You decide whether to send it, and it goes to us as an ordinary email.

Two things do happen that are not ours, and it would be dishonest to leave them out. The site is hosted on GitHub Pages, so GitHub’s servers see the ordinary request information any web server sees, including your IP address, and handle it under GitHub’s privacy statement. We have no analytics dashboard, no log access and no way to see who read what. And a page that embeds a live vault — the demos, and the reading app on a behaviour-policy page — loads that vault from vault.sgraph.ai, so opening those pages contacts SGraph the way opening any embedded page contacts its host. Everything in the vault is decrypted in your browser.

Writing to us

An email is an email, and a person reads it.

What we get: your email address and whatever you put in the message. No form builder, no CRM sitting in between, and no automatic list.
What we do with it: answer it. If it is a correction to something published here, it may produce a change on the site and a note in the release — the substance, not your address.
How long we keep it: in a mailbox, like any other mail. Ask us to delete it and we will.
Who else sees it: nobody outside the people running this, and no advertiser or data broker, ever.

Buying, and the work that follows

The cart is not ours, and neither is your card.

Payment happens at store.sgit.ai on the payment provider’s own pages. This site never takes a payment, never sees a card number, and issues no order reference. The boundary between the two sites is published.

What reaches us from a purchase: the order reference and the address you paid with, so that a person can write to you and deliver what you bought.
What we ask you for while doing the work: what your agent is connected to, at the level of names, and what your team believed it had authorised. That is the whole of it.
What we never ask for: credentials, tokens, keys, a seat in your environment, or the data your agent processes. Not at any level. Nothing we deliver sits in your request path, and we never connect to anything of yours.
At the corrected level, you run a prompt where your agent runs and send back what it produced. The page that describes it says what those files are and that they carry no secret; read them before you send them, because they are yours until you do.
Your vault key never appears on a page or in a committed file. It reaches you out of band, in a separate message to the address you paid with. A read key you may publish; the vault key you may not, and we cannot recover it for you.
The vault is yours. Its contents describe your deployment and are not published by us. The sixteen template policies are public on purpose, with their read keys printed, because a policy nobody can check is a policy asking to be trusted.

Your rights, and the address

Ask what we hold. It is a short answer.

If you have never written to us and never bought anything, the answer is nothing at all: there is no profile, no identifier and no record of your visit anywhere we can reach. If you have, write to dinis.cruz@owasp.org and ask for a copy of it, a correction to it, or its deletion. UK and EU readers have those rights in law and you do not need to cite the law to use them here.

RiskMandate is operated from London, United Kingdom. This page is written by the people who run the site rather than by a solicitor, and it describes what the site actually does rather than what a template says a site might do. If something here is wrong, tell us: it will be corrected on the page with a dated note, which is how every other correction on this site is handled. Last reviewed 24 September 2026.

The same rule as the rest of the site

A claim you can check beats a claim you must believe.

Every page here is in a public repository, every published policy has its read key printed, and this page tells you what to look for in your own browser. That is the whole method, applied to ourselves.

Read the source ↗What we do not claim