Application configuration

Configuration Hub controls organization-wide behavior. Changes are audited and some take effect immediately, so read confirmation messages carefully.

Organization and Base URL

Set the organization name and the public Base URL used in notification and workflow links. The Base URL must include http:// or https://, a host, and optionally an application path. Do not include a query string or fragment. A change takes effect after application restart.

Branding

The logo library stores up to five variants.

  1. Open Organization Settings > Branding.
  2. Add an optional internal label.
  3. Upload PNG, JPG, GIF, SVG, or WebP, no larger than 300 KB. Raster images must be at most 400 × 100 pixels.
  4. Choose whether to activate immediately.
  5. Save and verify the sign-in page and sidebar.

Activate an older variant to roll back. The active variant cannot be deleted.

Image needed: Branding logo library showing thumbnails, Active status, Activate, Rename, and Delete controls.

Configure the risk matrix

  1. Open Configuration Hub > Risk Matrix.
  2. Choose 3–10 likelihood levels and 3–10 impact levels.
  3. Enter scale labels or apply a preset.
  4. Define rating bands that cover the entire score range without gaps or overlaps.
  5. Choose accessible colors and review the live grid.
  6. Select Activate, read the warning, and type ACTIVATE when certain.

After activation, dimensions and score ranges are locked. Labels, band names, colors, and descriptions remain editable. Activation is blocked after risks have already been scored.

Maintain reference data

Use Reference Data for Impact Areas, Risk Factors, Regions, and Business Units.

  1. Open the relevant tab.
  2. Edit names, descriptions, and sort order.
  3. Add new rows or remove obsolete choices.
  4. Save and test a risk form.

Removal is a soft delete: new selections no longer show the item, while existing risks retain it.

File uploads and file encryption

Configure file size, allowed extensions, and optional malware scanning. Files above the scan-size threshold are accepted without scanning, so align the threshold with policy.

RiskVault can use customer-managed AWS KMS keys for stored files. After changing the key, wait for re-encryption to finish and verify it before disabling or scheduling deletion of the old key.

General Retention counts from the first Closed, Rejected, or Archived date. It determines when manual deletion becomes eligible; it does not automatically purge records.

Legal Hold Policies are reusable templates with a name, description, and optional default duration. Apply a policy from a risk's Details page or a register bulk action.

While any hold is active, it overrides general retention and blocks deletion. A hold marked Delete automatically when this hold ends can permanently purge the risk only after every active hold has expired with that flag. Permanent purge cannot be restored.

Releasing a hold early requires a meaningful reason of at least 10 characters.

  1. Open Configuration Hub > Data Retention & Legal Hold.
  2. Under Legal Hold Policies, create a name and description that explain the legal or records purpose.
  3. Set a default duration in days, or leave it indefinite.
  4. Save and make sure the intended hold managers understand when to use it.

A never-used policy can be deleted. Once it has been assigned, deactivate it instead so historical hold records remain understandable.

The Legal Holds area lists active holds across the register and allows authorized release with a reason. Holds are assigned from a risk or the Register bulk action, not from this list.

Configure external sign-in

  1. Open the external-authentication settings.
  2. Add or edit the supported provider, such as Microsoft, Google, or Okta.
  3. Enter the provider values supplied through your approved secret process.
  4. Test sign-in in a separate private browser session with a non-admin account.
  5. Confirm name, email, and identity linking.
  6. Keep a tested local administrator path before enforcing or changing external sign-in.
  7. Review provider health in Monitoring Hub.

When SCIM is enabled, it becomes the authority for creating new accounts. External sign-in authenticates the provisioned person rather than creating them on first use.

Configure email and test delivery

  1. Enter the organization's mail-server settings and sender identity.
  2. Store credentials through the intended protected settings mechanism.
  3. Use Test connection.
  4. Send a test to an internal recipient when the page supports it.
  5. Verify delivery, sender alignment, links, and spam handling.

Email configuration affects invitations, password reset, mentions, watched risks, schedules, and SLA digests. An in-app notification can succeed even when email fails.

Feature switches

Optional features remain hidden until enabled. Before changing a switch:

  1. Read its description and dependencies.
  2. Complete any required configuration or data preparation.
  3. Identify affected users and pages.
  4. Enable it in a controlled window.
  5. Test with intended and unintended roles.
  6. Monitor errors and provide user guidance.

Compliance Catalog and MCP both require preparation beyond flipping the switch. Follow their dedicated guides.

Monitoring Hub

Use Monitoring Hub to review the health of external sign-in, Jira, webhook processing, and enabled SLA digest or KPI jobs. A healthy configuration screen does not guarantee recent business events were delivered, so pair health checks with audit or activity records.

Configuration change checklist

  • Record the business reason and approver.
  • Capture the current value or rollback path.
  • Confirm secret-handling requirements.
  • Test with a normal account.
  • Check notification and absolute-link behavior after Base URL changes.
  • Verify audit history.
  • Communicate changes that affect required fields, access, scoring, retention, or integrations.