Security

RuntimeAI is a control plane that enforces governance on AI agents — it has to hold itself to at least the same bar. The controls below run in production today:

• Encryption — AES-256 at rest, TLS 1.3 in transit, FIPS 140-2 validated cryptographic modules
• Access Control — Role-based access with multi-factor authentication on every administrative surface
• Audit Logging — Immutable, tamper-evident audit trails for every data access and policy decision
• Tenant Isolation — Strict multi-tenant isolation enforced at the database, network, and application layers
• Incident Response — 24/7 security operations with documented incident response procedures

RuntimeAI does not hold or claim third-party certifications — no SOC 2 Type II attestation, no ISO 27001 certificate, no FedRAMP authorization, no HIPAA certification. Instead of asking you to trust a badge, we give your own security and compliance team the material to verify our practices directly.

On request and under NDA, we provide a compliance documentation package that includes:

• A CISA Secure Software Development Framework (SSDF) self-attestation
• SOC 2 Trust Service Criteria control mappings — a mapping of our controls to the criteria auditors evaluate, not a certificate
• A current threat model for the platform
• A software bill of materials (SBOM)

This lets your auditors evaluate our actual controls against the frameworks that matter to you (SOC 2, HIPAA, FedRAMP, ISO 27001, and others), rather than relying on a name on a certificate. Request the package at security@runtimeai.io.

For organizations that need the strongest possible data sovereignty guarantee, the recommended deployment model is on-premises or fully air-gapped — our Fortress and Sovereign tiers. In this model your data and agent traffic never leave your own environment, and there is no runtime dependency on RuntimeAI-hosted infrastructure.

Regulated customers (financial services, healthcare, government and defense) typically choose this model specifically so their own compliance posture doesn't depend on a third party's certification status.

If you believe you've found a security issue in the RuntimeAI platform, email security@runtimeai.io with details and reproduction steps. We investigate every report and will acknowledge receipt.