Risk Ledger is a supply chain cyber risk platform, which the company calls Active Supply Chain Security. Organisations use it to view suppliers' security profiles without repeated questionnaires, send standard assessments to suppliers not yet on the platform, and map supply chains several tiers deep. It is delivered as a cloud service.
Risk Ledger Ltd is based in London, United Kingdom, outside the EU, so UK law and the UK GDPR apply. For transfers, the privacy policy relies on EU standard contractual clauses and the EU-US Data Privacy Framework. It names AWS among its cloud hosts without naming a region, and confirms that a limited subset of personal data is transferred outside the UK, EEA and Switzerland. Ownership and hosting region are not stated by the vendor. For a European organisation, the UK headquarters and transfers of some data outside Europe are the main points to weigh.