Risk disclosures
A vendor that says they have no risks has not looked. This is the same register our board sees, lightly redacted for customer detail. Inherent rating is before mitigation; residual is what remains after our controls.
Disclosed risks
8
Reviewed quarterly by board
High residual
0
None at present
Medium residual
3
Mitigations in flight
Low residual
5
Within stated appetite
Material risks
Description
≈ 71% of pacer decisions touch Meta or Google APIs. A material API regression or policy change on either could degrade pacing accuracy for affected workspaces.
Mitigation
Multi-region API clients · canary releases · 30-day vendor change tracker · published fallback runbooks · monthly partner sync.
Description
Pacer relies on a forecast model with documented MAPE bands. In black-swan regimes (e.g., sudden inventory collapse) tail error can exceed bands.
Mitigation
Hard guardrails on /policies · pacer never exceeds policy cap regardless of model output · model card on /model-cards · drift monitor on /forecast-accuracy.
Description
Sub-processors on /legal/subprocessors include cloud and observability vendors whose compromise could affect availability or data integrity.
Mitigation
Annual vendor risk reviews · /vendor-risk live ratings · SLSA L3 build provenance on /supply-chain · contractual breach notification ≤ 24h.
Description
Treasury feature exposes the company to evolving EU payment-services and operational-resilience rules; non-compliance could limit payout corridors.
Mitigation
Regulatory map on /regulatory-map · quarterly counsel review · feature flags allow corridor disablement within 60 seconds.
Description
Trust ledger has a primary region; a multi-AZ failure plus a slow regional failover could delay write acknowledgements.
Mitigation
RTO ≤ 15 min / RPO ≤ 60 s on /resilience · quarterly DR drills on /dr-drills · automatic read-only mode that preserves customer visibility during failover.
Description
Top five customers represent ≈ 18% of ARR. Concentrated loss could pressure operating cash flow.
Mitigation
Diversification policy on /capital-allocation · multi-year contract weighting · no single customer > 8% individually.
Description
Despite least-privilege, an authenticated insider could attempt cross-tenant action.
Mitigation
JIT access on /access-paths · per-tenant data keys · continuous tenant-isolation tests on /tenant-isolation · 2-of-3 approvals on /payouts.
Description
Operating costs partially USD-denominated; sustained EUR weakness compresses gross margin.
Mitigation
Rolling 12-month FX hedge on /hedging · annual price-list review on /price-list · natural hedge from USD-billing customers.