Your risk data stays on your servers
Rosco is self-hosted. We never host, see or receive your register, and the software doesn't call home. This page is for the people who have to review it.
Where the data lives
- One database you run. PostgreSQL 15 or later, on your host or your managed service, plus a file store for attachments, imports and exports. Nothing else.
- Offline licences. Licence files are signed with Ed25519 and checked on your server. Nothing is sent to us, and Rosco installs and runs without internet access.
- Secrets sealed at rest. Identity-provider secrets, the SMTP password and webhook addresses are encrypted with AES-256-GCM under a key you hold.
- Backups that check themselves. One-step backup and restore with the CLI; a restore verifies the audit chain.
Who can see what
- Identity you already run. SAML 2.0 and OIDC single sign-on with Entra ID, Okta, Google Workspace and others; SCIM 2.0 provisioning and groups mapped to roles (Enterprise). Break-glass admin accounts when single sign-on is enforced.
- Local accounts done properly. Argon2id password hashing, a breached-password check that works offline, lockout after repeated failures, and two-factor authentication that admins can require.
- Access that holds at the database. Access by business unit is enforced by the API and again by PostgreSQL row-level security, so an application bug can't show one unit another's risks. System Admins don't see risk content unless they also hold a risk role.
- Sessions and tokens. HttpOnly, Secure cookies with idle and absolute timeouts; API tokens are scoped and stored only as hashes.
The record
- A hash-chained audit log. Every change is versioned and appended to a log in which each entry includes the hash of the one before.
rosco verify-auditrecomputes the chain, and the log can be forwarded to your SIEM. - Append-only where it matters. Risks are never deleted, only closed or archived, and the audit table refuses updates and deletes.
What you install
- Signed releases. Images are signed with cosign and carry a signed SPDX SBOM; release files are listed in a signed checksum file.
- Locked-down containers. An unprivileged user, a read-only root filesystem, no Linux capabilities.
- Browser protections. A strict content security policy, HSTS and framing denied.
Ask Rosco and AI risk
Two rules don't depend on the model behaving. Rosco can only do what the person asking can do, because every look-up goes through Rosco's own API as that person. And Rosco changes nothing itself: every change is a card the person applies.
- You choose where the AI runs. Anthropic's Claude API, Claude on AWS Bedrock, or an OpenAI-compatible server such as Azure OpenAI, or Ollama or vLLM on your own network. It's off until an admin sets it up and accepts a notice describing what data goes to that provider.
- Tested per provider, per release. An evaluation set of 55 scripted conversations, graded by rules, including planted-instruction and access cases. Every injection and access case must pass for a provider to be supported.
Against the OWASP Top 10 for LLM Applications (2026)
Our own assessment for release 0.11. "Partial" means met, with the limit stated.
| Risk | Status | How Rosco handles it |
|---|---|---|
| LLM01 Prompt injection | Partial | Rosco's instructions are fixed and never built from your data; record text reaches the model only as quoted information. No full prevention exists, so an obeyed instruction is limited to what the person can see, and to a card they must apply. |
| LLM02 Sensitive information disclosure | Met | The model sees only what the person asking can see. Confidential risks can be withheld entirely. Conversations are private to their owner and deleted after the retention period. |
| LLM03 Excessive agency | Met | No write tools: Rosco drafts, the person applies, through the same validation, approvals and audit as a manual edit. Viewers and Auditors get no drafting tools. |
| LLM04 Supply chain | Partial | Official provider SDKs, pinned. When you run your own model, its provenance is yours: run the evaluation set before switching Rosco on. |
| LLM05 Data and model poisoning | Met | Rosco doesn't train or fine-tune models and keeps no long-term memory between conversations. |
| LLM06 Unbounded consumption | Met | Monthly token budgets per person and for the organisation, a per-person rate limit, one reply at a time, and step and size limits. |
| LLM07 Misinformation | Partial | Scores and bands are computed by Rosco, not the model; a citation becomes a link only if Rosco read that record. The model can still be wrong, so the person checks before applying. |
| LLM08 Hidden context exposure | Met | The instructions hold no keys or access rules; access is enforced by the API. The provider key is sealed and never placed in the model's context. |
| LLM09 Vector and embedding weaknesses | N/A | No vector store or retrieval index: Rosco searches the register through the API as the person. |
| LLM10 Improper output handling | Met | Replies render as a small Markdown subset with no HTML, outside links or images. Model output never reaches SQL, a shell or an outbound request. |
Where we are
Rosco is at pre-release 0.11. Our own testing is done: an OWASP ASVS 4.0.3 Level 2 checklist and the LLM Top 10 assessment above. An external penetration test is planned before version 1.0. We don't hold a security certification today.
Ask for the detail
Security reviewers can have the ASVS checklist, the LLM Top 10 assessment, the penetration test scope and the dependency review. Email hello@roscoriskmanagement.com.