Security
Last Updated: 2026
Security is foundational to RuneSpoke. As a cloud-hosted, AI-native developer platform that touches source code, repositories, AI provider credentials, and deployment pipelines, we design the Service to protect customer data at every layer. This page describes the practices and controls we use to keep your data safe.
Encryption
- In transit. All traffic between your browser, our APIs, and our services is encrypted using TLS. We use modern cipher suites and enforce HTTPS across the platform.
- At rest. Customer data and backups are encrypted at rest using industry-standard algorithms managed by our cloud infrastructure provider.
- Secrets. Sensitive values, including AI provider keys and integration tokens, are encrypted before storage and decrypted only at the moment they are needed to fulfill a request.
Credential Vault
RuneSpoke operates on a Bring Your Own AI model, which means you connect your own AI provider keys. These keys, along with OAuth tokens and other integration secrets, are stored in an encrypted credential vault. Secrets are encrypted at the application layer with per-record protection, are never exposed in plaintext in the user interface, and are accessible only to the minimum set of services required to perform authorized operations on your behalf.
Access Controls and RBAC
Access to the Service is governed by role-based access control (RBAC). Permissions are granted on a least-privilege basis, and sensitive operations are gated behind fine-grained permission checks at the API layer rather than only in the user interface. Authentication uses short-lived access tokens with refresh tokens delivered as HTTP-only cookies, optional two-factor authentication, token revocation, CSRF protection, and rate limiting.
Agentic Access Control and Audit Logging
Because RuneSpoke runs AI agents that can act on your behalf, we apply a dedicated layer of agentic access control. AI agents operate within scoped capabilities bounded by the live permissions of the human who delegated to them, subject to guardrails such as spend and blast-radius limits. High-impact actions follow a propose-not-commit model, where the agent stages an action for human approval rather than executing it directly. Every privileged action, whether taken by a human or an agent, is recorded in an audit log so that activity can be reviewed and attributed.
Infrastructure
The Service is hosted on Amazon Web Services (AWS) and benefits from the physical security, network controls, and resilience of AWS data centers. We run agent and preview workloads in hardened, isolated sandboxes with dropped capabilities and default-deny network egress during autonomous operation, so that untrusted code cannot reach the broader network or exfiltrate data. We apply security patches, monitor for anomalies, and separate production from non-production environments.
Responsible Disclosure
We welcome reports from security researchers. If you believe you have found a security vulnerability in the Service, please report it to security@runespoke.ai. We ask that you give us a reasonable opportunity to investigate and remediate before public disclosure, and that you avoid accessing or modifying data that is not your own. We will acknowledge legitimate reports and work to resolve verified issues promptly.
Certifications and Compliance
We are actively pursuing SOC 2 Type II, and this work is in progress and on our roadmap. We have not yet completed certification and do not claim to hold it. For more detail on our data handling and regulatory posture, see our Compliance page.
Contact Us
For security reports: security@runespoke.ai
For general security questions: legal@runespoke.ai
General inquiries: hello@runespoke.ai
RuneSpoke, Walnut Creek, CA
This page is a general overview of our security practices and is not a substitute for your own due diligence or legal review. Please contact us if you require additional detail for your evaluation.