Risk Management Policy¶
| Field | Value |
|---|---|
| Status | draft |
| Owner | DIR |
| Applies to | All Partile processing, systems, and product decisions; the basis on which every other control is justified. |
| Review cadence | Annual; plus per-PR reassessment when a change affects privacy/security/safety/availability (the upkeep rule). |
| Mapped controls | GOV-01 (decision log), and all controls (risk is the basis for each). |
| Evidence | readiness/threat-model-and-auth-review.md (STRIDE-lite + gap register); READINESS.md decision log and milestone gates; ../counsel-queue.md. |
| Exception handling | Risk acceptance is an explicit, dated DIR decision in the READINESS.md decision log with an owner and review date. |
Purpose¶
Define how Partile identifies, assesses, treats, and accepts risk so that control investment tracks actual product risk — not a generic checklist.
Method (lightweight, ISO 27005-shaped)¶
- Identify risks from: the live threat model
(
readiness/threat-model-and-auth-review.md), the milestone gates inREADINESS.md, per-PR review, and incidents. - Assess by likelihood × impact, with Partile-specific impact weighting: the online→offline dimension means harassment/stalking is a safety risk, not merely an abuse risk, and is weighted accordingly.
- Treat — mitigate (a control), avoid (don't build it), transfer
(insurance/vendor —
C24), or accept (dated decision). - Record in the control register (status + evidence) and, where legal, in
../counsel-queue.md.
Standing high-priority risks (current)¶
| Risk | Treatment | Control / evidence |
|---|---|---|
| Re-identification of "pseudonymous" presence/match data (airport+gate+time is a small anonymity set) | Treat all proximity data as personal data; anonymization standard gates ML | PRIV-06, ML-04, C8 |
| Blocked/abusive user reaching a target via matching or messaging | Symmetric block enforced at every read/derive path | SAF-01, SAF-04 |
| Special-category (Art 9) inference from LinkedIn headline / route data | Hard constraint: never infer/derive/store protected attributes | ML-02, C13 |
| Insecure production default (dev routes, public data stores, missing secret-store wiring) shipped | Production preflight assertions before any real data | SEC-05, SEC-08, SEC-09 |
| No production incident/breach process yet | IR policy + playbook drafted; 72h clock documented | SEC-13, C19 |
| Single-operator key-person / availability risk | Backups + reviewed PRs + this data room reduce bus-factor | OPS-01, OPS-04 |
Risk acceptance¶
Where a risk is knowingly carried (e.g. public Cloud Run invoker requiring a
project-scoped Domain Restricted Sharing exception, or pre-launch seed data in
production), DIR records the acceptance with rationale, compensating control, and
the milestone by which it must be revisited in
../registers/action-register.md.
Acceptance is never silent and never permanent without a review date.
Counsel-gated risks¶
Legal/privacy risks do not block engineering: they are built to a documented
working assumption and queued in ../counsel-queue.md for one-pass ratification
(per the READINESS.md policy). An overturned assumption becomes a scoped change
request against the named control.