Trust center
Security, stated plainly
No badge-wall theater: live controls are marked, in-flight certifications are dated. Ask for anything missing — enterprise@runaii.cloud.
| SOC 2 Type II | In audit — report Q1 2027 | Roadmap |
| HIPAA | Roadmap — BAA with Enterprise VPC | Roadmap |
| Secrets at rest | AES-256-GCM (RUNAII_SECRETS_KEY) | Live |
| API keys at rest | SHA-256 hash only — secrets never stored | Live |
| Sessions | httpOnly, SameSite=Lax, 30-day TTL | Live |
| Audit log | All security events, 1-year retention | Live |
| Pen tests | Annual third-party + continuous internal | Roadmap |
| Data residency | GLOBAL / US / EU / APAC pins | Live |