Spreadsheets don't survive an exam. RCSA as a continuous discipline does.
The first RCSA platform built for every stakeholder — not just the teams completing the assessment.
FirstlineIQ is the first RCSA platform built for every stakeholder in the risk and compliance ecosystem — not just the teams completing the assessment. First-line owners complete intake in plain English. Second-line analysts challenge, approve, and export with a full evidence trail. Internal audit accesses an immutable record without asking anyone for a spreadsheet. Compliance teams map every control to their regulatory obligations automatically. Examiners get a defensible, timestamped history of every risk decision. And senior management moves from reviewing an annual artifact to watching risk posture in real time.
Spreadsheets emailed once a year. First-line owners who don't understand inherent versus residual risk. Manual aggregation that takes weeks. Ratings that fail credible challenge. A regulatory export assembled at the last minute from a dozen inconsistent files.
FirstlineIQ replaces that entire process with a structured, AI-assisted platform spanning the full RCSA lifecycle — from first-line intake through second-line review, credible challenge, materiality determination, approval, and regulatory export.
Every decision is captured. Every rating is computed deterministically. Every version is immutable. The result is RCSA data that regulators can trust — and that your second-line team doesn't have to reconstruct from email chains.
The gap assessment engine surfaces control deficiencies between assessment cycles — when there's still time to remediate before the next exam. The platform recommends specific evidence artifacts so first-line teams know exactly how to demonstrate control effectiveness.
Board-ready reports in PDF or XLSX — paste directly into your institution's templates. RCSA KPI and KRI monitoring keeps risk posture visible between assessment cycles.
Standard License — Included
Automatically mapped to these frameworks.
Reg Intel (Enterprise)
“Natively monitored. Automatically flagged when regulatory documents change.”
Compass interviews first-line risk owners in plain English — no methodology training required. It maps responses to risk taxonomy categories, prompts for evidence uploads, and generates a structured RCSA draft grounded in your firm's document library. Every AI-generated field carries a citation or confidence flag. No field is auto-populated without user confirmation.
All ratings follow defined matrices exactly — no rounding, no approximation. Overrides require documented justification and second-line approval. Every computation stored with inputs, outputs, timestamp, and user identity.
Every RCSA maintains a working draft and an immutable approved baseline, enforced at the database level. A diff engine surfaces every change at the start of each refresh cycle. Regulatory export always one click from the approved baseline.
Full on-premises deployment powered by open-weight LLM inference running entirely within your infrastructure. Zero egress. No external API calls. Application, database, document store, secrets management, and AI inference all run inside your infrastructure. Requires GPU-equipped server (NVIDIA A10G or equivalent) to meet sub-5-second Compass response time.
Platform lives on your infrastructure. You bring your own LLM API key — OpenAI, Anthropic, Azure OpenAI, or Google. Your data agreement with the LLM provider is yours to own and control. API keys encrypted at rest with AES-256-GCM, never logged, never returned by the API, and masked in the UI after entry. MFA mandatory when cloud model configuration is activated.
FirstlineIQ hosts and manages the platform. You bring your own LLM API key. Managed infrastructure. Your data agreement, your choice of model. Suitable where speed matters and data residency permits hosted deployment.
Complete SaaS deployment. FirstlineIQ provides everything — platform, infrastructure, and LLM inference. No infrastructure to provision, no API keys to manage, no operational overhead. All four deployment tiers share the same feature set — the only difference is where things run and who manages what.
The engine of RCSA oversight. FirstlineIQ gives second-line analysts a structured, auditable surface for credible challenge, materiality determination, force actions, and regulatory export — without the manual aggregation.
Business unit operators who know their domain deeply but not risk methodology. Compass meets them in plain English, asks the right questions, and guides them through intake without requiring them to understand inherent versus residual risk.
Operational risk teams responsible for overseeing the RCSA process, managing user access, configuring methodology, and maintaining audit chain visibility. FirstlineIQ replaces the spreadsheet distribution list and manual access review with a proper administrative surface.
We'll walk you through a live demo configured around your deployment tier preference — from fully air-gapped on-premise to full SaaS. No generic slide deck. The demo runs on ACE_IQ Inc. — a fictionalised community bank with sixteen active RCSAs — so you see the full lifecycle, not just the intake flow.
This Privacy Policy describes how FirstlineIQ LLC ("FirstlineIQ," "we," "us," or "our"), collects, uses, and handles information in connection with your use of the FirstlineIQ platform and website at firstlineiq.com.
We collect information you provide directly to us, including:
We also collect certain technical information automatically when you access our website or platform, including IP address, browser type, operating system, referring URLs, and usage logs. We do not use third-party advertising trackers or sell user data.
We use the information we collect to: provide, operate, and improve the FirstlineIQ platform; respond to demo requests and support enquiries; send service-related notifications; fulfil contractual obligations to licensed customers; and comply with applicable legal and regulatory requirements.
We do not use your RCSA data or document content to train AI models, share data with third parties for marketing purposes, or process personal data beyond what is necessary to deliver the platform services.
FirstlineIQ supports four deployment tiers, including fully on-premises deployments (Tier 1 and Tier 2) where all data remains within the customer's own infrastructure. For Tier 3 and Tier 4 hosted deployments, customer data is stored on infrastructure managed by FirstlineIQ LLC, subject to the data processing terms in your master services agreement.
For on-premises deployments, FirstlineIQ LLC does not have access to your data unless explicitly granted for support purposes. For hosted deployments, we maintain appropriate technical and organisational measures to protect your data consistent with the security architecture described in our platform documentation.
For Tier 1 deployments (local open-weight model inference), all AI processing occurs on your own infrastructure. No data is transmitted to external AI providers. For Tier 2 and Tier 3 deployments using a customer-provided LLM API key, data processing by the AI provider is governed by the customer's own data processing agreement with that provider. For Tier 4 deployments, AI processing is subject to FirstlineIQ LLC's data processing terms.
FirstlineIQ LLC does not use customer RCSA data, risk records, or document content to train, fine-tune, or improve AI models.
We retain website enquiry data (demo request submissions) for up to 24 months or until you request deletion. Platform data retention for licensed customers is governed by the customer's master services agreement and applicable regulatory requirements. The FirstlineIQ platform is designed to support a minimum 7-year audit log retention requirement consistent with financial services regulatory standards.
We implement appropriate technical and organisational measures to protect information against unauthorised access, disclosure, alteration, and destruction. The FirstlineIQ platform architecture includes TLS 1.2+ in transit, AES-256-GCM encryption at rest, immutable audit logging with hash chaining, and role-based access control enforced at both application and database levels. Secrets management is handled via OpenBao with no credentials stored in code or configuration files.
Depending on your location, you may have rights under applicable data protection law, including the right to access, correct, or delete personal data we hold about you. To exercise these rights, contact us at [email protected]. We will respond to verifiable requests within the timeframe required by applicable law.
Our website uses only essential functional cookies required for operation. We do not use advertising cookies, third-party analytics trackers, or cross-site tracking technologies. Platform sessions use server-side state management with a session token; no sensitive data is stored in browser cookies.
We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or email to licensed customers. Continued use of the platform following notice of changes constitutes acceptance of the updated policy.
Questions about this Privacy Policy should be directed to: [email protected] — FirstlineIQ LLC.
These Terms of Service ("Terms") govern your access to and use of the FirstlineIQ platform and website at firstlineiq.com, operated by FirstlineIQ LLC ("FirstlineIQ," "we," "us," or "our"). By accessing or using the platform, you agree to be bound by these Terms.
By accessing the FirstlineIQ website or using the FirstlineIQ platform, you represent that you have the authority to bind yourself or the organisation you represent to these Terms. If you do not agree to these Terms, you may not access or use the platform.
Subject to these Terms and to payment of applicable fees, FirstlineIQ LLC grants you a limited, non-exclusive, non-transferable, non-sublicensable licence to access and use the FirstlineIQ platform during the subscription term solely for your organisation's internal risk management purposes. This licence does not include the right to: resell or commercially exploit the platform; modify, reverse engineer, decompile, or disassemble any part of the platform; use the platform to build a competing product or service; or remove or alter any proprietary notices or labels on the platform.
The FirstlineIQ platform, including all software, algorithms, methodologies, documentation, trademarks, and related intellectual property, is owned by FirstlineIQ LLC and its licensors. Nothing in these Terms transfers ownership of any intellectual property to you.
Customer data — including RCSA records, risk and control data, evidence documents, and any other content you create or upload to the platform — remains your property. You grant FirstlineIQ LLC a limited licence to process your data solely to the extent necessary to provide the platform services as described in these Terms and your master services agreement.
You agree to use the platform only for lawful purposes and in accordance with these Terms. You must not: use the platform in any way that violates applicable law or regulation; upload or transmit malicious code, files, or content; attempt to gain unauthorised access to any part of the platform or its underlying infrastructure; interfere with or disrupt the integrity or performance of the platform; or use the platform to process data you are not authorised to handle.
You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You must notify us immediately of any unauthorised use or suspected breach of security. FirstlineIQ accounts are provisioned through Keycloak SSO; credential management is governed by your identity provider configuration and the platform's authentication policy.
Access to the FirstlineIQ platform is subject to a subscription agreement and applicable fees as set out in your master services agreement with FirstlineIQ LLC. Fees are non-refundable except as expressly provided in your services agreement or required by applicable law.
THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, FIRSTLINEIQ LLC DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. FIRSTLINEIQ LLC DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY DEFECTS WILL BE CORRECTED.
FirstlineIQ is a risk management tool designed to support your organisation's RCSA process. It does not constitute legal, regulatory, compliance, or professional advice. You are solely responsible for ensuring that your use of the platform satisfies applicable regulatory requirements.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL FIRSTLINEIQ LLC, ITS OFFICERS, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, REVENUE, DATA, BUSINESS, OR GOODWILL, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR YOUR USE OF THE PLATFORM, EVEN IF FIRSTLINEIQ LLC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
FIRSTLINEIQ LLC'S TOTAL CUMULATIVE LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR IN CONNECTION WITH THESE TERMS SHALL NOT EXCEED THE AMOUNTS PAID BY YOU TO FIRSTLINEIQ LLC IN THE TWELVE MONTHS PRECEDING THE CLAIM.
You agree to indemnify, defend, and hold harmless FirstlineIQ LLC and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with your use of the platform, your violation of these Terms, or your violation of any rights of a third party.
FirstlineIQ LLC may suspend or terminate your access to the platform at any time for breach of these Terms, non-payment of fees, or for any other reason with reasonable notice. Upon termination, your licence to use the platform ends immediately. Data export and retention following termination are governed by your master services agreement.
These Terms are governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of law provisions. Any dispute arising out of or relating to these Terms shall be subject to the exclusive jurisdiction of the courts of the State of New York.
We may modify these Terms from time to time. We will provide notice of material changes via the platform or email. Continued use of the platform after the effective date of any change constitutes acceptance of the updated Terms. If you do not agree to the updated Terms, you must stop using the platform.
Questions about these Terms should be directed to: [email protected] — FirstlineIQ LLC.