Every credible company can name its own top risks. What are yours — the ones that would actually hurt us as your customer?

The full executive answer

I'll give you the real register, not the sanitised one. Risk one: concentration — we run a single production cell (Supabase in Tokyo on AWS) and a small number of critical providers; a severe regional or provider outage takes us down with it. Mitigations: provider-level backups and point-in-time recovery, immutable deploys with instant rollback, and a multi-region architecture that's config-ready (EU and India cells are coded but not yet provisioned). Risk two: key-person dependency — a founder-led engineering organisation. Mitigation: an unusually explicit codebase — the working agreements, invariants, and controls are written into the repository itself with 344 test suites enforcing them, so the system's knowledge outlives any individual — but I won't pretend that fully substitutes for team depth.

Risk three: AI output quality — our product's value is the credibility of machine-generated analysis, so a confidently wrong output is our existential product risk. This is where our engineering is deepest: dual-provider consensus on board-tier outputs, provenance requirements forcing every number to trace to a source, schema validation on every response, and an evaluation harness that regression-tests AI behaviour in CI without live model calls. Risk four: assurance gap — no SOC 2, no ISO certificate, no external pen test yet, which slows enterprise sales and means our controls lack independent validation; the dated remediation path runs through Q4 2026 (Type I, pen test) into mid-2027 (Type II). Risk five: regulatory — the EU AI Act classification of our workforce modules awaits counsel, and we've pre-built the geo-gate rather than pre-judged the answer.

What I'd want you to take from this: none of these risks is hidden from you, each has a named mitigation and, where relevant, a date — and the product we're selling you is literally a governed risk register for AI, so running our own risks through that discipline is the least credible thing we could fail to do.