Who we are
Rosco Risk Management is a trading name of Beanbay Pty Ltd ("we", "us"). We are responsible for personal information collected through roscoriskmanagement.com and the licence portal at portal.roscoriskmanagement.com, and we handle it in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). You can contact us about privacy at hello@roscoriskmanagement.com.
The Rosco software
Rosco is self-hosted: you install it on your own servers or cloud account, and your risk register, the people in it and its files stay there. We don't host it, can't see it, and receive none of it. Licences are checked on your server, offline, and the software doesn't contact us.
If your organisation switches on Ask Rosco, the AI assistant, your installation sends the text it needs directly to the AI provider your administrator chooses: Anthropic, AWS Bedrock, an OpenAI-compatible service, or a model on your own network. That happens under your organisation's agreement with that provider. It doesn't pass through us.
Your organisation is responsible for the personal information it keeps in its own Rosco installation.
This website
- No cookies, no analytics, no tracking. We don't measure visits, use advertising tools or load anything from third parties. Fonts and images are served from this site.
- Server logs. Our host, Vercel, records technical details of each request (such as your IP address, browser type, the page and the time) to run and protect the site. We don't use these logs to identify visitors.
- Email. If you email us, we receive your address and what you write, and use them to reply.
The licence portal
You use the portal to start a trial, buy a licence and download licence files. It collects:
- Your account: your email address, and your name if you give it. You sign in with a link we email you, optionally with a one-time code from an authenticator app.
- Your organisation: its name, country and tax number (such as an ABN or VAT number), the people you invite and their roles, and, if you choose, the host name your licence is tied to.
- Trials: the email address, organisation name and pricing model you asked for. We use the email domain to offer one trial per organisation.
- Subscriptions and licences: your plan, quantities, billing period and the licence files we issue.
- Payments: handled by Stripe. You enter your card or bank details on Stripe's own checkout page; we never see or store full card numbers. Stripe tells us the payment status and gives us your invoices.
- A record of activity: sign-ins, purchases, licence issues and changes, kept as a log that can't be edited, so licensing can be audited.
- One cookie: a sign-in session cookie that lasts up to 12 hours. It's needed for the portal to work, and isn't used for tracking.
How we use it
To create and secure your account, issue and renew licences, take payment, send you licence files, receipts and notices about your subscription (such as a failed payment or an expiring licence), answer your questions, meet our tax and legal obligations, and prevent fraud and misuse. We don't sell personal information, and we don't send marketing email unless you ask us to.
Who we share it with
Only the service providers that run these services for us, and only what each needs:
- Stripe, for payments, invoices and tax calculation.
- Vercel, which hosts this website.
- The providers that host the licence portal and deliver its email.
- Our professional advisers, such as accountants and lawyers, when needed.
We may also disclose information when the law requires it.
Overseas
Some of these providers store or process information outside Australia, including in the United States. Stripe and Vercel operate internationally. We choose providers with strong security and contractual privacy protections. Ask us if you'd like the current list of providers and where they process data.
Security and how long we keep it
The portal stores only a fingerprint (hash) of sign-in links and session cookies, encrypts authenticator secrets, and uses encrypted connections throughout. Sign-in links expire after 15 minutes.
We keep account, licence and billing records while you have an account, and afterwards for as long as tax and accounting law requires, generally five years in Australia. The activity log is kept for the same reason. When we no longer need information, we delete or de-identify it.
Access, correction and deletion
You can ask to see the personal information we hold about you, have it corrected, or have it deleted where we don't need to keep it. Owners can update their organisation and invited people in the portal. For anything else, email hello@roscoriskmanagement.com. We'll reply within 30 days, and we may need to confirm who you are first. These requests are open to everyone, wherever you live.
Questions and complaints
Contact us first at hello@roscoriskmanagement.com and we'll try to resolve it. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the privacy regulator where you live.
If we change this policy, we'll update the date at the top. If we change it in a way that matters to portal customers, we'll email them.