1. Executive boundary
Runstamp is local-first document software with optional hosted services. Local/self-hosted SDK operation can keep source documents and outputs entirely inside Customer infrastructure. Data is sent to Plain Works only when Customer deliberately uses a hosted endpoint, managed connector, support channel, or enabled telemetry path.
This Kit summarizes public facts and is not a certification, audit report, service-level agreement, or substitute for an executed Order Form, DPA, architecture review, or provider-state attestation.
2. Deployment models
| Model | Data boundary | Plain Works responsibility |
|---|---|---|
| Local Apache-2.0 SDK | Customer runtime; no Runstamp network call required for ordinary local operation | Published package/source integrity and license commitments only |
| Enterprise offline entitlement | Customer runtime; signed certificate can be checked locally | Issue a valid scoped certificate and protect signing material |
| Hosted Runstamp feature | Runstamp-managed providers listed on Subprocessors page | Hosted application/infrastructure controls and DPA obligations |
| Customer-selected connector | Data flows to destination/scopes selected by Customer | Secure the Runstamp side and execute Customer instruction |
Runstamp does not currently offer a Runstamp-operated dedicated Customer VPC or private-worker deployment, SSO/SAML and SCIM. Those capabilities are not shipped, and an Order Form does not make them available without a future delivered product contract.
3. Offline license model
Where offered, the entitlement certificate uses an Ed25519 signature over a versioned payload containing organization, tier, allowed formats/features, scope, issue time, and expiry. Customer runtimes receive the public verification key, not the signing private key. They should pin the approved key/certificate, restrict distribution, and monitor expiry.
The current supported envelope begins with pjsx_offline_v1_. Provision and pin the reviewed public key from /.well-known/runstamp-license-public-key.pem; do not fetch it dynamically for each offline verification.
Offline operation cannot receive instant online revocation. Compromise response may require certificate replacement, expiry, signing-key/version rotation, and updated SDK deny-list material. The exact token format and key location are implementation details and may change compatibly; rely on the supported verifier rather than parsing undocumented fields.
4. Hosted controls
Hosted controls include managed authentication; organization authorization and roles; TLS; provider-managed encryption at rest; protected secrets/signing material; structured audit events (audit_events); rate limiting; logging and monitoring; deployment/dependency review; backup/recovery; retention workflows; incident response; and provider review. Raw keys, document bytes, and secrets must not be placed in audit metadata.
Current ordinary lifecycle targets include 24-hour unbound staging, 7-day generated hosted artifacts, 90-day security logs, 24-month usage/audit data, 60/90-day successful/failed webhook records, and up to 35 days for isolated backup overwrite after live deletion. Release authority is the deterministic source, migration, scheduled-job, and automated-verification contract for those controls; provider attestation is not a release authority.
5. Questionnaire answers
| Question | Answer |
|---|---|
| Can document processing run without internet? | Yes for supported local packages and eligible offline entitlements; hosted features/connectors require connectivity. |
| Does local execution send documents to Runstamp? | No, unless Customer invokes a hosted/telemetry/support path. |
| Does Runstamp use hosted AI on Customer Content? | Not currently as a core hosted subprocessor. Customer-selected local AI is Customer-controlled. |
| Are payments stored by Runstamp? | Paddle is merchant of record; Runstamp does not store complete card/bank credentials. |
| Is personal data sold? | No. |
| Is a DPA available? | Yes, for hosted Customer Personal Data at /legal/dpa; the public privacy notice is at /legal/privacy. |
| Are subprocessors public? | Yes, at /legal/subprocessors. |
| Is SOC 2 complete? | No. SOC 2 is IN PROGRESS/planned; do not treat that work as certification or as a completed report. |
| Are ISO 27001, HIPAA, PCI DSS, FedRAMP certifications claimed? | No, unless a current signed or published report explicitly says otherwise. |
6. Evidence and review
Before an enterprise commitment, confirm the exact packages/features, deployment diagram, data flows, regions, identities, keys, connectors, retention jobs, backup rotation, monitoring, incident contacts, recovery objectives, support/service levels, and required contractual terms. Public code or documentation alone does not prove that a production control is enabled.
Security questionnaires, privacy/DPA, and commercial requests: hello@runstamp.com