Regulatory control mapping, operational resilience facts, CAIQ-lite answers, and every contract document — honest about what's shipped and what isn't. Everything below is self-serve: no call required to get an answer.
Runback supports your controls — it is not, by itself, a compliance certificate.
| Framework | Requirement | Runback control | Evidence produced |
|---|---|---|---|
| EU AI Act · Art. 12 | Automatic event logs for high-risk AI systems over their operational lifetime — enforceable since 2 August 2026 | Every decision context, model version, and policy state is cryptographically sealed the moment it happens — a tamper-evident record we call a cassette | Exportable cassette file per run, verifiable without Runback |
| EU AI Act · Art. 14 | Human oversight — ability to understand, monitor, and override AI outputs | Policy gates block non-compliant calls before execution; sealed record enables post-hoc review | Policy block events are cassette entries with rule, predicate, and full decision context |
| APRA CPS 230 | Operational incidents and near misses must be identified, escalated, recorded, and addressed — CPS 230 does not name AI; this applies to any material business process, AI-driven or not | Deterministic replay of any agent decision from the exact captured context | Re-executable run record with the exact inputs the model received |
| APRA CPS 230 | Critical operations must stay within tolerance during disruption, with a business continuity plan to maintain them | Policy gates fail open by default; failed trace sends retry in-process on the next flush | Fail-open design; Enterprise can configure fail-closed |
| APRA CPS 234 | Information security commensurate with the degree of risk | PII redacted before storage (in-process on first-party SDKs, server-side on OTel); RBAC; self-hosted VPC option | Redaction log; RBAC audit trail; self-host keeps your data entirely in your perimeter |
| NIST AI RMF · Govern 1.2 | Organisational accountability for AI risk decisions | Every decision attributed to a specific run, model version, and policy state — tamper-evident | Every decision is cryptographically signed and independently time-stamped by outside authorities — so no one, including Runback, can quietly edit history after the fact. (Ed25519-signed digest per run, HMAC-SHA256 fallback without a keypair; append-only Merkle-chained ledger; two independent RFC 3161 timestamp authorities.) |
| NIST AI RMF · Measure 2.5 | AI system performance monitoring in production, including drift detection | Continuous capture of decisions with policy evaluation; model diff on real production inputs | Model diff report showing behavioural change before a model upgrade ships |
| NIST AI RMF · Govern 4.1 | Independent oversight — the org's own risk decisions are subject to external review | A time-limited, read-only key scoped to specific runs (or all of them) grants an auditor or regulator the same signed record your own team sees — no platform login, no export handed over blind | Byte-identical signed audit record, downloadable by the external party directly; every access checked for expiry and revocation, not just at issuance |
Architecture and data-handling summary — shipped controls and honest roadmap. Read it →
The DPA, Terms, and Privacy Policy for your legal team. Signed DPA on request.
Enterprise master services agreement with SLAs and governing terms. Request at legal@runback.dev.
Pre-filled answers to standard vendor assessment questions.
Self-hosted deployments clear most of these automatically — when nothing leaves your perimeter, most answers are “you control it.”
Self-host in your own VPC — your data never reaches us. Managed cloud resides in the United States (US). EU or Australian residency requires Enterprise self-hosted.
Self-host: you choose the region — your cloud, your perimeter. Managed cloud: US only. Enterprise self-hosted gives you full control of the infrastructure and region.
Yes. Managed cloud uses TLS throughout. Self-host runs behind your own TLS terminator. Session cookies are Secure + httpOnly.
At-rest encryption relies on your Postgres and disk encryption. Application-level field encryption is on the roadmap — not yet shipped, disclosed on our security page.
RBAC with four roles — owner, admin, member, viewer — enforced on every privileged route. The last owner cannot be removed.
Passwordless magic link, and enterprise OIDC SSO (Okta, Microsoft Entra ID, Google Workspace, Auth0, Ping).
Keys, emails, card numbers (Luhn-checked) and SSNs are redacted before storage. On the Vercel AI SDK and Python/LangGraph collectors this happens inside your process, before any trace leaves it; OpenTelemetry integrations send raw spans to us first and are redacted server-side, before storage or display. Standard and strict tiers, plus custom patterns.
Yes — tampering is detectable, not just discouraged. Each run is a SHA-256 hash chain with a digest signed by Ed25519 by default: asymmetric, verifiable offline against our published key, so non-repudiation doesn't require trusting our servers. Without a keypair, deployments fall back to HMAC-SHA256 — integrity, but not non-repudiation, since the verifier holds the same key. Every checkpoint is also time-stamped by two outside RFC 3161 authorities we don't control and published to a public, hash-chained append-only feed (GET /api/transparency), so two divergent but honestly-timestamped histories would sit side by side for anyone who archived it — closing the one gap time-stamping alone leaves open. Self-hosted customers holding their own AUDIT_SIGNING_KEY / AUDIT_ED25519_PRIVATE_KEY improve their position further.
Supabase Inc. (US) — managed Postgres database (stores agent traces, account data, audit logs). Resend Inc. (US) — transactional email delivery (magic-link sign-in and alert notifications). Vercel Inc. (US) — application hosting and edge delivery for the managed cloud; receives request data in transit and provides cookieless page analytics for the marketing site, but does not store agent trace content. Note: Lemon Squeezy LLC acts as Merchant of Record for paid subscriptions and is an independent data controller for payment data — it is not a sub-processor bound by Runback's DPA. The complete list, with the change-notification commitment, is in the DPA; countersignable copy at legal@runback.dev.
Yes. Agent trace cassettes use the open, documented runback.cassette/v1 JSON format, exportable per run any time — no Runback account or software needed to read them after export. Chargeback data exports as CSV; compliance reports as structured JSON. Managed cloud provides a data export window before deletion; self-hosted customers own the Postgres database outright. These support your GDPR Art. 20 data-portability obligations.
Delete any run at any time. On termination we delete or return your data within 30 days, except where retention is required by law. Self-host: entirely under your control.
No. We do not train models on your data and do not sell personal data.
Observation runs async — never in your agent's critical path. Policy gates fail open by default so your agent is never blocked by Runback downtime. A failed trace send is requeued in-process and retried on the next flush — that buffer is in-memory only, not persisted to disk, so events not yet flushed are lost if the process exits first.
None yet, and none in audit. SOC 2 Type II is planned but not started — the observation window alone runs 3–6 months, so we won't imply it's closer than it is. What exists today: a control-by-control mapping on the security page, against shipped mechanisms, not intentions. We operate GDPR-aligned, with a DPA on request. Self-host keeps your data in your own perimeter, which simplifies your own compliance posture.
Not yet by an independent third party — we won't claim an assessment we can't produce a report for. Security work to date is internal: adversarial testing of the audit verifier and tamper-evidence chain, CI guards against cross-tenant reads and unbounded queries, and the control-by-control review on the security page. An external test is planned alongside SOC 2 Type II; we'll publish the date once engaged. Self-hosted deployments run in your own perimeter — your team's standard assessment process applies, and we'll support it.
Email security@runback.dev. We acknowledge within two business days and credit reporters once a fix ships.
On managed cloud: infrastructure staff have database-level access. On the Vercel AI SDK and Python/LangGraph collectors, PII is redacted inside your application process before anything arrives — card numbers, emails, and SSNs never reach us. On OpenTelemetry-fed integrations, raw spans reach our servers and are redacted before storage — the unredacted payload transits our infrastructure, even though it isn't retained unredacted. Either way, the redacted trace content that remains is readable by anyone with database access. Self-hosted: your data never touches our servers; this question doesn't apply.
Self-hosted customers own the database — records remain in your infrastructure regardless of what happens to Runback. Managed cloud: cassette files use an open, documented format (runback.cassette/v1) with a public schema, and export/verify independently without our software or an account. We provide a data export window before any cessation of service.
The append-only ledger is designed so removing an entry breaks the hash chain — that's the point of tamper-evidence. Our approach: redaction keeps personal data from reaching the cassette. If PII did reach a managed-cloud cassette and a verified erasure request arrives, we delete the run record, breaking the chain at that point — the break is itself the honest record. Self-hosted: you own the database and the erasure decision.
Yes, on Enterprise. An admin issues a time-limited, read-only key from Settings — scoped to specific runs or to all of them — and hands it directly to the auditor. It downloads the exact same signed audit record your own team would see, byte-identical, not a summary. Revocable at any time; access is checked for expiry and revocation on every read, not only when the key is issued.
The same regulatory mapping and CAIQ answers above, structured — so a security tool or a script can pull them directly instead of someone re-typing this page into a spreadsheet.
curl https://runback.dev/api/procurement | jq .caiq
curl https://runback.dev/api/procurement | jq .regulatory_mappingFor the questions the page and the API don't answer, bring your security team — we bring the documents.