Skip to content
RunningLake
Company Console ↗ Request early access
Contents: Govern and secure

NOT HELD We do not hold this.

Compliance

Which controls are whose, and where each framework stands. The short version is on this page; the long version is on the trust page and the controls list.

Where each framework stands

We hold no SOC 2 report, no HIPAA business associate agreement, no ISO 27001 certificate and no PCI DSS attestation. Not in progress: none. FedRAMP is not planned. If your procurement requires one of these today, that is a reason to wait, and the trust page says so in the same words. It also gives each framework’s place in the order we mean to pursue them, which is a sequence and not a set of dates.

Whose each control is

Every control is one of three kinds. A control that is RunningLake’s is one we run, and can show evidence for. A control that is yours is one only you can run, such as deciding who is a member of your organisation and keeping access to your own cloud account in order. A control that is shared holds only if both do their part, and the part that is yours is named with the control.

Your part is usually one of a few things: removing members and tokens when people leave, keeping access to your own cloud account in order on a plan with a plane in it, and keeping data you must protect out of what the control plane holds. The control plane holds your account identity, the names you declare, the text of your queries, sealed and kept for a limited time, the statements people save, sealed and kept until they delete them, and the SQL of your pipelines, in your project’s repository and in run records. Your tables’ files stay on your plane, and where that plane is depends on whether you connect one or we host it: your bucket is the one in your own cloud account, registering your own key is built in the console and is not switched on yet, and the trial is designed to run on a bucket of ours.

The controls list shows each control, the criteria it serves and whose it is, one control at a time.

How a control is held

The controls list says, for each control, whether it operates today, is designed and not built, or is a gap. A control that says it operates names the test or job that holds it, and our build fails when that evidence is renamed or removed, or when a gap’s work is finished without the control being moved. That is how the list stays true between reviews.