Risk Hub 01 · Platform
Commercial risk intelligence

Risk that does not look like risk. Until something breaks.

Platform
Risk.

The commercial risk created when a digital business depends on another platform to sell, get paid, deliver work, reach customers, store data or operate day to day.

365 Risk Desk · Independent commercial risk intelligence Reading time · 8 minutes
01   Context

Why platform risk matters now.

Most digital businesses now run on rented infrastructure. Stripe or another processor handles the money. Shopify or a custom stack runs the storefront. AWS or another provider hosts the systems. Meta, Google and TikTok deliver the customers. Apple and Google control the app distribution. Each one is a single point of failure with terms that can change, accounts that can be reviewed, algorithms that can shift and policies that can affect distribution.

Platform events can interrupt revenue, customer access and delivery before the business has a clear route to respond. By the time the issue surfaces, the recovery process often sits inside a dispute system the business does not control.

Most digital businesses do not have a balance sheet problem. They have a dependency problem they have not mapped.

The commercial impact is rarely the headline event. It is the cash flow gap, the team time absorbed and the operational disruption that follows. The businesses that handle platform events well are the ones that mapped the dependencies before anything went wrong.

02   Framework

The three layers
of platform risk.

Platform risk is not one thing. It sits across three commercial layers. Each layer carries different exposure, different recovery times and different consequences when something moves.

I

The Distribution Layer

What changes when customers cannot find you

How customers discover and reach the business. The most volatile layer. Algorithms shift, ad accounts are reviewed, marketplace rankings move. Recovery is rarely on the operator's timeline.

Ad platforms Marketplaces App stores Search Social
II

The Transaction Layer

What changes when money cannot move

How revenue is collected, held and paid out. The fastest to bite. A processor review, a reserve increase or a payout delay can interrupt cash flow inside 48 hours, before the business knows it is happening.

Processors Payment rails Banking partners Reserves Chargebacks
III

The Operational Layer

What changes when the systems stop running

How the business actually runs day to day. The slowest to surface but the hardest to unwind. Hosting, SaaS tooling, fulfilment, customer data. When this layer moves, every other process moves with it.

Hosting SaaS tools Customer data Fulfilment Workflow

A digital business is only as resilient as its weakest layer. Mapping the dependencies across all three is the first commercial step toward managing them.

03   Diagnostic

Common warning
signs.

Platform risk usually builds quietly before it surfaces. The signals are visible inside the operating model long before any platform takes action. Eight conditions worth checking now, weighted by how concentrated the exposure typically becomes.

Watch Elevated Concentrated
01 / 08
Revenue concentration
Heavy reliance on a single payment processor, marketplace, app store or platform account with no tested alternative in place.
02 / 08
No backup payment rail
A second processor signed up but never tested in live commercial conditions.
03 / 08
Customer data locked in
No exported customer list, order history or communication record held outside the primary platform.
04 / 08
Single acquisition channel
Reliance on one ad platform, algorithm, search channel, marketplace ranking or partner route for customer acquisition.
05 / 08
No suspension plan
No documented process for handling an account review, restriction, hold, suspension or policy change.
06 / 08
Distribution dependency
Reliance on a single app store, marketplace, partner portal or platform relationship for product distribution.
07 / 08
Unknown platform terms
Limited understanding of reserve rights, rolling holds, appeal routes, data export limits, takedown powers or termination rights.
08 / 08
No internal owner
No named person tracking platform relationships, access rights, account health, policy changes and recovery routes.
Each condition is manageable in isolation. Two or three concentrated signs stacked together describe a business that may struggle to absorb a single platform event without commercial disruption.
04   Self diagnostic

Run a seven minute
platform risk check.

Seven questions. Answer honestly. The score updates as you go and tells you whether the business is carrying limited, moderate or concentrated platform risk. No email required.

Your exposure score
0/7
Answer the questions to see your reading
Recommendation pending
Start full assessment →
Q.01
Do you know what percentage of revenue, customer access or fulfilment passes through each platform you depend on?
Q.02
Do you understand your payment processor's reserve and rolling hold terms in plain language?
Q.03
Do you know your platform's review and appeal process before you need it?
Q.04
Do you have a second payment rail, sales route or fulfilment route tested and live, not just signed up?
Q.05
Do you own and regularly export usable customer data outside the platform?
Q.06
Do you have an alternative customer acquisition channel that is not dependent on a single algorithm, ad account or marketplace?
Q.07
Do you have an internal owner who tracks policy changes, access rights and recovery routes across the platforms you rely on?

A higher score means more areas where the business is currently absorbing platform risk without a tested response.

Free full diagnostic

Map the commercial risk
across your business.

The Business Risk Assessment extends the platform check above into a full commercial diagnostic across platform, contract, payment, customer and operational areas. Free, independent, takes around fifteen minutes.

Take the assessment →
05   Live signals

Currently watching.

Manual watchlist · May 2026
Transaction layer
May 2026

Payment processor reserve language before growth events.

A processor review does not need to become a crisis if the business already understands reserve terms, chargeback thresholds and payout timing. Check the terms before a campaign, launch or revenue spike.

Signal · Watch
Distribution layer
May 2026

App store and marketplace policy dependency.

Pricing, subscription, external link and distribution rules can change the commercial model quickly. Businesses relying on one store or marketplace should keep a current view of the terms they operate under.

Signal · Elevated
Operational layer
May 2026

Single vendor SaaS concentration.

Critical workflows often sit inside one SaaS stack without a tested export, backup or exit path. Map billing, customer data and operational handoffs before the vendor becomes difficult to replace.

Signal · Watch
06  ·  The Risk Desk Brief

A weekly read on risk that does not look like risk.

Written for founders, operators and finance leaders running digital businesses. Independent. Free. Delivered to your inbox.

Free weekly brief

Get the next edition straight to your inbox.

Subscribe →
07   Library

Related resources.

Deeper analysis on the platform risk areas covered above. All free to read.

Read the analysis
Featured · Transaction layer
Why did Stripe freeze my account?
Payment processor reviews, frozen funds and delayed payouts can create immediate commercial pressure for digital businesses. The signals founders should check first, the conversations to have with the processor, and the operational moves that limit the damage.
Read the guide
Transaction layer
Customer chargebacks rising
Rising chargebacks are rarely just a fraud issue. They are an early commercial signal.
Read
Operational layer
Platform migration risk
Hidden commercial risk underestimated until revenue, data, integrations or rollback readiness is disrupted.
Read
Operational layer
SaaS and technology risk
The systems a digital business runs on shape its commercial resilience.
Read
Customer layer
Customer support queue review
An underused early warning system that turns tickets, response times and customer friction into operational intelligence.
Read
08   Questions

Frequently asked.

Platform risk is the commercial exposure a business carries through its dependence on third party platforms for revenue, payments, hosting, distribution or customer access. It includes the risk that a platform changes terms, reviews an account, alters an algorithm or affects distribution, and the operational and financial impact that follows.
Distribution, transaction and operational. Distribution covers how customers find and reach the business. Transaction covers how revenue is collected, held and paid out. Operational covers the systems the business runs on day to day. Each layer carries different exposure, recovery time and consequences when something moves.
Operational risk covers the internal systems, processes and people inside the business. Platform risk sits one layer outside that, in the third party services the business depends on but does not control. The two interact closely. A platform event almost always becomes an operational issue.
Payment processor reviews and reserve increases. Account reviews on advertising platforms. Marketplace or app store policy changes. Hosting and infrastructure interruptions. Sudden policy or terms changes. Algorithm shifts that affect distribution or visibility. Reduced access to customer data held inside a platform.
If one platform carries a material share of payments, customer acquisition, fulfilment, distribution or customer data access, and there is no tested alternative in place, the business may be carrying concentrated platform risk. The diagnostic above gives a quick reading. The Business Risk Assessment goes deeper.
Many businesses review platform dependency on a regular cycle, and after any material platform, product, payment, marketplace, app store, hosting, fulfilment or customer support change. The aim is to catch shifts in concentration or terms before they become commercial issues.
General information notice

365 Risk Desk publishes general commercial risk intelligence and educational resources for digital businesses. The content on this page is independent general information only. It is not legal, financial, insurance, regulatory or professional advice and should not be relied on as such. Any specific decision about a business, contract, platform relationship, insurance arrangement or legal position should be discussed with the appropriate professional adviser. See also the Payment Risk hub and the Contract Risk hub.

Common Warning Signs

Platform risk usually builds quietly before it surfaces. The signals are visible inside the operating model long before any platform takes action.