RRune

Security

We build security tools. We take our own seriously.

This page is the short version of Rune's security posture: where your data sits, what we collect (and don't), how we encrypt things, and how to reach us if you find something wrong.

01

Architecture

Scanning runs in-process inside your application. Only derived metadata — never raw prompts or tool parameters — leaves your infrastructure. The cloud surface is a thin ingestion layer plus a dashboard.

┌─────────────────────────────────────────────────────┐
│  SDK  (your application process)                    │
│  • L1 regex · L2 vector · L3 LLM judge              │
│  • Policy evaluation                                 │
│  • Scans inputs, outputs, tool calls                 │
└──────────────────────┬──────────────────────────────┘
                       │  event metadata only
                       ▼  (no raw prompts, no tool values)
┌─────────────────────────────────────────────────────┐
│  Worker  (Cloudflare Edge · 300+ regions)           │
│  • Authenticates · routes · rate-limits              │
└──────────┬────────────────────────────┬─────────────┘
           ▼                            ▼
   ┌────────────────┐           ┌──────────────┐
   │   Tinybird     │           │    Convex    │
   │   analytics    │           │  state · UI  │
   │ (events, stats)│           │ (policies,   │
   │                │           │  alerts)     │
   └────────────────┘           └──────────────┘
02

Data handling

What we collect

Event metadata
timestamp, agent ID, event type
Scan results
risk score, threat category, pattern IDs
Performance
scan latency, layers executed
Policy outcomes
allow / block decision, rule matched

What we do not collect

Raw prompts
never sent to cloud by default
User content
stays in your application
LLM responses
scanned locally, not transmitted
Tool parameters
only argument hashes, not values
03

Encryption

In transit
TLS 1.3 enforced on all API endpoints. HSTS enabled. No plaintext fallback.
At rest
Tinybird encrypts analytics data at rest with AES-256. Convex encrypts all stored data.
API keys
Hashed with SHA-256 before storage. Raw keys are never persisted.
04

Authentication

SDK
API key header (X-Rune-Key) on every request. Keys are scoped per organisation.
Dashboard
OAuth 2.0 (GitHub, Google) or email / password with bcrypt. Session tokens are JWTs signed with RSA.
Worker
API keys validated against Cloudflare KV with constant-time comparison.
05

Infrastructure

Edge compute
Cloudflare Workers — 300+ locations. No single point of failure.
State
Convex — SOC 2 Type II compliant, real-time sync, automatic backups.
Analytics
Tinybird — SOC 2 Type II compliant, encrypted storage, configurable retention.
DNS / CDN
Cloudflare — DDoS protection, WAF, bot management included.
06

Compliance

Rune is pursuing SOC 2 Type I certification. The infrastructure providers Rune depends on (Convex, Tinybird, Cloudflare) are independently SOC 2 certified.

SOC 2 Type I
In progress. Target completion Q3 2026.
GDPR
We process event metadata as a data processor. No PII collected by default. DPA available on request.
Data residency
Tinybird region (US / EU) configurable on Growth and above.
07

Responsible disclosure

Found something? Tell us. We read every report, acknowledge within 48 hours, and will not pursue legal action against researchers acting in good faith.

Report to
security@runesec.dev
Response time
48 hours to acknowledge. 7 days to resolve critical.
Safe harbor
No legal action against researchers who disclose responsibly.
08

Questions we get

Does Rune see my users’ prompts?

No. Scanning runs locally in the SDK. Only metadata (risk score, threat type, scan latency) is sent to the cloud. Raw content never leaves your infrastructure.

What happens if the Rune cloud is unreachable?

The SDK keeps scanning locally. L1 and L2 work entirely offline. Events are queued and flushed when connectivity resumes. Your agents are never blocked by our infrastructure.

Can I run Rune entirely on-premises?

The scanner package (@runesec/scanner) is open source and runs anywhere with zero dependencies. For the full platform with dashboard and alerting, email us about self-hosted deployment options.

How do you handle data retention?

Plan-dependent: 30 days (Community), 90 days (Starter), 180 days (Pro), 365 days (Growth). Data is automatically purged after the retention period.

Questions about security? Email security@runesec.dev.
Security | Rune