Security and the use of artificial intelligence in RAISE

In RAISE artificial intelligence reads the uploaded documents and proposes their fields, which an operator confirms, corrects or rejects. Each user sees only their own scope, the most sensitive roles normally sign in with a second factor, every action stays in a verifiable audit trail and every assessment must be approved by a validator. The product's security controls are mapped to the NIST SP 800-53 Rev. 5 catalogue.

The role of artificial intelligence

What artificial intelligence does

It reads the uploaded documents.
It proposes the fields: an operator confirms, corrects or rejects them; an unconfirmed field is never used.

Where artificial intelligence is not used

The risk index, calculated with a transparent formula.
Live alerts, generated by fixed rules.
Approvals, which are given by a validator.

Access and scopes

Sign-in through RAISE's sign-in service; validators, auditors and administrators are normally also asked for a code of six digits.
Six roles, each on a structure; every query stays inside the user's scope.
An asset outside the scope does not appear, not even through a direct address.

Traceability

Every action in the audit trail, chained to the previous one: the check reports the first change, if any.
Approvals and rejections with their reasons.
Source files are kept unchanged and identified by their SHA-256 fingerprint.

Data in site reports

Location and device data are removed from JPEG and PNG photos.
The report form reminds users to describe facts, not people.
The audit trail records the site, type and severity of a report, not its text.

Controls and transparency

RAISE's security controls are mapped to NIST's catalogue of controls; the one on artificial intelligence refers to NIST's framework for managing AI risk.References: NIST SP 800-53 Rev. 5 and NIST AI RMF 1.0
In the app, the Standards page lists the standards applied, each with its supporting evidence.References: the standards listed in the Trust center
Every release comes with a CycloneDX SBOM: the software bill of materials, listing its components.References: Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex I, Part II, point 1; NIST SP 800-218 (SSDF 1.1), practice PS.3.2
Development with tests written before the code, pinned versions and a full code review before the release.References: NIST SP 800-218 (SSDF 1.1), practices PW.7 (code review) and PW.8 (testing executable code)

This site

raisesecops.it uses no cookies or tracking tools and loads no resources from third-party servers.

Frequently asked questions

Does RAISE use external artificial intelligence services?

No. In the current version the models that read documents make no calls to external artificial intelligence services.

Who can access a site's data?

Only users who have that site in their scope, that is in their own structure or in one below it. For all other users the site is not visible.

How can changes to the audit trail be detected?

The trail is append-only and each event is chained to the previous one: the chain check recomputes the chain and reports the first change, if any.

What does an auditor see?

The audit trail, read-only, with filters by user, action, object and dates, and the check of the chain of events.