Security
RunningLake cannot reach into your network.
Your cluster opens the connection to us, and the control plane never dials in — hosted and BYOC run the identical mechanism, so the BYOC path cannot rot from disuse. That connection is not encrypted in transit on the environment we run today, and encrypting it and authenticating both ends of it are not built yet.
Where we stand
No SOC 2. No HIPAA BAA. No ISO 27001. No PCI DSS. Not “in progress” — none. We have no completed SIG and no third-party penetration test report. If your procurement process requires any of those today, we are not yet a vendor you can buy from, and we would rather you learn that on this page than in week three of a security review.
The controls we list describe the control plane we run today. Operating means true of the control plane we run today; a separate production environment is not provisioned yet.
- GDPR Month 14 NOT STARTED Not started.
- SOC 2 Type I Month 17 NOT STARTED Not started.
- SOC 2 Type II Month 21 NOT STARTED Not started.
- HIPAA + BAA Month 25 NOT STARTED Not started.
- PCI DSS Level 1 Month 30 NOT STARTED Not started.
- ISO 27001 Month 34 NOT STARTED Not started.
- FedRAMP NOT PLANNED Not planned.
Those month numbers are positions in a sequence, counted from a funding close that has not happened. They are not dates, and we will not present them as dates until there is a clock to count from. A framework reads “in progress” only when an assessor is engaged and the date readiness started is on record.
Assessments
Threat model
Written for every trust boundary; awaiting independent review.
Penetration test
Not booked.
For your security review
Report a vulnerability
Write to security@runninglake.com with what you found and how to reproduce it. Please leave customer data out of the message. The same address is in our security.txt.
The trust boundary
The shape of the schema, and a check on every message, are the enforcement mechanism, not a convention. No message in the agent protocol is meant to carry customer data: LogRef, not Log. ResultHandle, not ResultSet. Opaque ids, never names. The control plane refuses a message that does not fit its shape. A free-text summary is held to a shape too (its characters, its length, no SQL phrase), which makes a stray name or table name unlikely and does not prove one impossible.
The data plane writes a query’s result to its own object storage: the control plane is handed a short-lived link, never the rows, and your browser follows it. It is told how many rows and bytes, how long the query took and what it cost. It also holds the text of a query you submit: sealed when it is stored, and held readable only in the command that delivers it, until the query settles. A statement a person saves is a separate copy, sealed and kept until they delete it.
For a fully private cluster with no egress path at all, a tunnelled fallback exists behind a per-organisation flag. It defaults to off and is shown in a data-residency panel when it is on, because an exception that is invisible is not an exception, it is a surprise.
Where the AI layer meets your data, stated plainly: no model is called yet, so what follows is the design, not the build. The context store is split by origin: the names you declare live in the control plane, and what is discovered from your data (inferred meanings, profiles and samples) stays in your own bucket, with only ids and numbers travelling up. A value reaches a model’s context only from a table classified public or internal, and only with sampling turned on, which is off by default. Bringing your own model endpoint is planned for the Team tier, declared per project and approved by an owner or admin.
What is designed and built
Encryption
Envelope encryption in four levels: a root key in your own KMS or CloudHSM, which you control and can revoke, then a tenant key rotated every 90 days, then a per-column key rotated on policy change, then the column data itself as AES-256-GCM, authenticated. TLS 1.3 in transit, mTLS between planes. Registering a key of your own for a project, which is built in the console and not switched on yet, is separate from these four levels, which remain planned.
Credentials
No ambient credentials in any engine. The catalog vends short-lived, table-scoped tokens per job, and for regulated tiers each individual file read is pre-signed, scoped to one file and one operation.
Policy, compiled per engine
Authored once, compiled to each engine’s own mechanism. A cross-engine conformance suite runs on every deploy and gates the release: a policy that behaves differently on DuckDB than on Trino is a P0 incident, not a bug.
Audit and lineage
Append-only, hash-chained audit: a database trigger refuses a plain update, delete or truncate. You take an export and check the chain yourself; delivery to your own bucket is not switched on yet. Lineage is recorded for the table edges your project declares in git (what a view declares it reads, and the order a pipeline gives its own assets) and for the tables a view’s SQL and a pipeline asset’s inline SQL read. It is kept by the control plane, by id, and nothing is sent up from your data plane for it. The SQL is read by the control plane’s own SQL parser, a local service with no network route and no credential that logs a digest and never a statement. A statement kept in a file is not read yet, so what it reads is not shown. Observed lineage is not recorded yet. Every autonomous action is logged with no option to disable it.
One more qualification worth stating on this page rather than a footnote: your bucket is the one in your own cloud account, where a plane you connect keeps your tables’ files, and registering your own encryption key is built in the console and is not switched on yet. A plane we host is in our account, and the trial is designed to run on a bucket of ours. “Your data never leaves your account” is true of where your tables’ files are stored on a plane in your own account, and we will not write it unqualified.