Operation inputRunstamp engineTyped result
Security
Know where your documents are processed.
Choose local or managed execution and review the data handling, isolation, retention, and access controls for that deployment.
Execution boundariesPick the runtime for the document
Authenticated inputBounded jobFile + record
How it works
Security follows the deployment option you choose.
CALLER
- context
- tenant
- input
- native bytes
Choose where it runs
Process in your environment, or through a free trial or an active Platform or Enterprise workspace.
EXECUTION
- schema
- validated
- cancel
- supported
Control access
Use workspace, environment, and credential controls.
RESULT
- output
- file / error
- retention
- surface policy
Set retention
Keep inputs and results per the selected service and policy.
Answers from the security policy.
Where are my documents processed?
In local or self-hosted use, in your own runtime. Runstamp does not receive local-only data unless you send it to a hosted endpoint, managed connector, support channel, or telemetry service. Hosted features run on Vercel and Supabase; the Supabase database and storage are in the United States (see the subprocessor list).
How long are hosted files kept?
Unbound execution input and staging files are kept 24 hours. Generated hosted artifacts are kept 7 days unless your plan or Order Form says otherwise. Backups are overwritten within up to 35 days after live deletion.
What is logged?
Usage and organization audit records are kept 24 months. Webhook delivery records are kept 60 days when successful and 90 days when failed. Security and authentication logs are kept 90 days unless needed for an incident.
Is the hosted service doing AI processing on my documents?
No managed OpenAI, Gemini, or Anthropic processing is part of Runstamp's core hosted chain today. A future managed AI feature must update the legal and vendor disclosures before launch.
Does Runstamp hold SOC 2, ISO 27001, or similar certifications?
No claim is made. Runstamp does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, or similar certification unless a current written report expressly says so.
How do I report a vulnerability?
Email hello@runstamp.com with the affected component and version, reproduction steps, impact, and a safe proof of concept. Do not access others' data or disclose publicly before a reasonable response period. No paid bounty is promised.