1. Boundary
Runstamp is local-first software with optional hosted services. In local/self-hosted use, Customer controls runtime, documents, outputs, dependencies, network, credentials, backups, and deployment. Plain Works does not receive local-only data unless Customer deliberately sends it to a hosted endpoint, managed connector, support channel, or telemetry service.
For hosted systems, Plain Works protects the application, managed infrastructure, service identities, and administrative access under its control. This overview is not a certification, audit report, invulnerability warranty, or guarantee that every control applies to private/quarantined features.
2. Hosted access and data
Controls include managed authentication, organization/tenant authorization, roles, protected administrative access, TLS, provider-managed encryption at rest, secret storage, scoped connectors, structured audit records, rate limits, error/availability monitoring, deployment review, backups, incident procedures, and vendor review.
Hosted inputs and generated artifacts follow the Privacy Policy lifecycle. Do not place raw API keys, signing secrets, credentials, or unnecessary Customer Content in logs, metadata, webhooks, analytics, or support messages.
3. Offline entitlements
Eligible Enterprise entitlements may use an Ed25519-signed certificate verifiable offline with the published public key. The signing private key remains server-side. Customers should pin the approved public key, restrict certificate distribution, monitor expiry, and understand that immediate online revocation cannot reach a fully offline environment. Replacement, expiry, key-version rotation, and updated deny-list material provide the revocation path.
4. Package and supply-chain responsibility
Public packages identify their own license and dependencies. Customers should pin versions/lockfiles, verify registry/source provenance, scan dependencies, protect CI credentials, review release notes, and test outputs. Private, prerelease, experimental, or quarantined packages are not production commitments merely because source exists.
5. Connectors, outputs, and AI
Customer-selected connectors and destinations operate under Customer scopes and provider terms. Generated documents may contain active links, macros, embedded media, metadata, or third-party content depending on the format and inputs; Customer must inspect and safely distribute them.
No managed OpenAI, Gemini, or Anthropic processing is currently part of Runstamp's core hosted chain. Customer-selected local AI remains Customer's responsibility. A future managed AI feature must update legal/vendor disclosures before launch.
6. Operations, incidents, and assurance
We investigate suspected incidents, contain affected systems, preserve relevant evidence, remediate, recover, and send legally required notices. Better Stack supports uptime/status communication; PostHog supports sanitized diagnostics. No uptime or response guarantee applies without an Order Form.
Runstamp does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, or similar certification unless a current written report expressly says so. Planned or in-progress work is not certification.
7. Vulnerability reporting
Email hello@runstamp.com with affected component/version, reproduction steps, impact, and a safe proof of concept. Do not access others' data, persist, disrupt service, extort, or publicly disclose before a reasonable response period. No paid bounty is promised.
Security and privacy/DPA: hello@runstamp.com