Privacy Policy

RuntimeAI collects information necessary to provide our AI governance platform services. This includes:

• Account Information — Name, email address, company name, and role when you create an account or request a demo.
• Usage Data — Telemetry about platform usage, feature engagement, and performance metrics, collected in aggregate and anonymized.
• Agent Metadata — Agent identity tokens, policy enforcement logs, and governance audit trails processed through the platform.
• Communications — Information you provide when contacting support or submitting partner applications.

We do not collect, store, or process the content of AI agent prompts or responses unless explicitly configured by the tenant administrator for audit purposes.

We use collected information solely for:

• Providing and improving the RuntimeAI platform and services
• Processing account registration and demo requests
• Sending service-related communications (security alerts, maintenance notices)
• Generating anonymized, aggregate analytics to improve product quality
• Complying with legal obligations and regulatory requirements

We never sell your personal information to third parties. Marketing communications are opt-in only.

RuntimeAI implements enterprise-grade security measures aligned with SOC 2 Trust Service Criteria control mappings — a self-attested control-mapping practice, not a third-party certification claim:

• Encryption — AES-256 at rest, TLS 1.3 in transit, FIPS 140-2 validated modules
• Access Control — Role-based access with multi-factor authentication
• Audit Logging — Immutable, tamper-evident audit trails for all data access
• Tenant Isolation — Strict multi-tenant data isolation at the database, network, and application layers
• Incident Response — 24/7 security operations with documented incident response procedures

On request and under NDA, RuntimeAI provides a compliance documentation package — including a CISA Secure Software Development Framework (SSDF) self-attestation, SOC 2 Trust Service Criteria control mappings, a current threat model, and a software bill of materials (SBOM) — so your own auditors can verify these practices directly rather than rely on a third-party certificate.

RuntimeAI supports configurable data sovereignty controls:

• Regional Deployment — Choose your data residency region (US, EU, APAC, or custom)
• Air-Gapped Option — Our Fortress and Sovereign tiers support fully air-gapped, on-premises deployment — the model we recommend for customers who need maximum data sovereignty and want zero dependency on RuntimeAI-hosted infrastructure
• Cross-Border Controls — Configurable data transfer policies with transparency reporting
• Right to Deletion — Tenant administrators can request complete data deletion at any time

Under applicable privacy laws (GDPR, CCPA, and others), you have the right to:

• Access your personal data and obtain a copy
• Correct inaccurate personal data
• Request deletion of your personal data
• Restrict or object to processing
• Data portability in machine-readable format
• Withdraw consent at any time

To exercise these rights, contact us at privacy@runtimeai.io.