First-run setup
A new installation has no users and no default password. The first administrator is created through a one-time setup step protected by a setup token.
- Get the setup token. The operator who deployed the server provides it — it is generated on first start, stored only in the server data directory (file
setup-token, readable withnode server/cli.js setup-tokeninside the container) and is never shown in the web interface or logs. - Open the platform. Go to /app/. While no administrator exists, the platform offers the first-run setup.
- Create your organisation and administrator. Enter the token, the organisation name, and the administrator’s name, email and a strong password.
- Configure. Review rating bands, risk categories and units, then invite users and assign roles.
The token works once. After setup succeeds, it can no longer be used to create accounts.
Signing in
Use Sign in with the email and password your administrator created. Sessions are protected server-side and expire after inactivity. Switch between Arabic and English at any time from the language toggle — your data is the same in both.
Roles & permissions
Permissions are enforced by the server on every request, not only hidden in the interface. Each user belongs to one organisation and sees only its records.
| Role | Typical use |
|---|---|
admin | Manages users, roles, organisation settings, rating bands and integrations. Full access to all modules. |
risk_manager | Maintains the risk register, assessments, treatments, KRIs and controls. |
compliance_officer | Maintains obligations, requirements, assessments, evidence and compliance actions. |
auditor | Plans engagements, records findings and recommendations, follows up actions; read access to risks and controls. |
executive | Views dashboards and reports, and approves items routed to them. |
viewer | Read-only access to the records and dashboards they are permitted to see. |
Risk scoring
Likelihood and impact are each rated on a 1–5 scale, for both inherent risk (before controls) and residual risk (after controls and treatment).
Risk score = Likelihood × Impact (1–25)
The score is placed in a rating band. Bands are configurable by an administrator; the defaults are:
| Band | Score range (default) |
|---|---|
| Low | 1–4 |
| Medium | 5–9 |
| High | 10–15 |
| Critical | 16–25 |
The 5×5 heatmap colours each cell by its band. Click a cell to list the risks in it. There is no single standard formula for every organisation — adjust the bands to your own methodology and risk appetite.
Compliance rate
Compliance % = compliant ÷ applicable assessed requirements × 100
- Not applicable requirements are excluded from both numerator and denominator.
- Not yet assessed requirements are excluded and reported separately as coverage.
- Partially compliant requirements count with a configurable weight (for example 0.5); set it to 0 to count only full compliance.
Framework libraries (ISO 31000, ISO 27001, COSO, NIST CSF, COBIT, NCA ECC, SAMA and others) are configurable: you load content you are licensed to use. The rate shows your own assessment — it is not a certification.
Indicators (KPI / KRI / KCI)
Each indicator has a direction (higher or lower is better), a target, and warning and alert thresholds. The status of every recorded value is calculated from those thresholds, and trend charts show the target and thresholds as reference lines.
Exports & reports
- XLSX and CSV — export registers and indicator values from the list views.
- Printable reports — open a report and use your browser’s print dialog, then choose Save as PDF. Navigation and buttons are hidden in print.
Intelligence
Insights come from explainable local analytics: rule-based anomaly detection, trend detection, clustering of similar findings, and treatment suggestions. They run on your server, and each insight shows the rule and data that produced it.
Integration with an external AI model is optional and disabled by default. It requires administrator configuration and explicit approval of what data may be transferred.
Demo data
A workspace may be loaded with sample records for evaluation. When it is, a banner says so on every page. Demo figures are illustrative only and should be removed before real use.