Security
RunningLake cannot reach into your network.
Your cluster makes one outbound TLS connection to one hostname on 443, which you can allowlist at your egress proxy. The control plane never dials in — hosted and BYOC run the identical mechanism, so the BYOC path cannot rot from disuse.
What we do not hold
No SOC 2. No HIPAA BAA. No ISO 27001. No PCI DSS. Not “in progress” — none. We have no completed SIG and no third-party penetration test report. If your procurement process requires any of those today, we are not yet a vendor you can buy from, and we would rather you learn that on this page than in week three of a security review.
| Framework | Sequence position | Status |
|---|---|---|
| GDPR | Month 14 | NOT STARTED |
| SOC 2 Type I | Month 17 | NOT STARTED |
| SOC 2 Type II | Month 21 | NOT STARTED |
| HIPAA + BAA | Month 25 | NOT STARTED |
| PCI DSS Level 1 | Month 30 | NOT STARTED |
| ISO 27001 | Month 34 | NOT STARTED |
| FedRAMP | Not planned | NOT PLANNED |
Those month numbers are positions in a sequence, counted from a funding close that has not happened. They are not dates, and we will not present them as dates until there is a clock to count from.
The trust boundary
The schema is the enforcement mechanism, not a convention. No message in the agent protocol can carry customer data: LogRef, not Log. ResultHandle, not ResultSet. Opaque ids, never names. Query results stream from the data plane directly to your browser; the control plane sees only rows, bytes, duration and cost.
For a fully private cluster with no egress path at all, a tunnelled fallback exists behind a per-organisation flag. It defaults to off and is shown in a data-residency panel when it is on, because an exception that is invisible is not an exception, it is a surprise.
Where the boundary is not absolute, stated plainly: the per-tenant context store lives in the control plane and holds schemas, column-level lineage, run history and sampled statistics — derived customer data. The rule keeping raw values out of a model’s context is scoped to columns classified as sensitive, so values from unclassified columns can reach a model API. Bringing your own model endpoint is Enterprise-only today.
What is designed and built
Encryption
Envelope encryption in four levels: a root key in your own KMS or CloudHSM, which you control and can revoke, then a tenant key rotated every 90 days, then a per-column key rotated on policy change, then the column data itself as AES-256-GCM, authenticated. TLS 1.3 in transit, mTLS between planes.
Credentials
No ambient credentials in any engine. The catalog vends short-lived, table-scoped tokens per job, and for regulated tiers each individual file read is pre-signed, scoped to one file and one operation.
Policy, compiled per engine
Authored once, compiled to each engine’s own mechanism. A cross-engine conformance suite runs on every deploy and gates the release: a policy that behaves differently on DuckDB than on Trino is a P0 incident, not a bug.
Audit and lineage
Append-only, hash-chained audit, exportable to your SIEM, enforced by database trigger and grant rather than by application code. Column-level lineage from every engine and every agent action. Every autonomous action is logged with no option to disable it.
One more qualification worth stating on this page rather than a footnote: your bucket and your own keys start at the Business tier. The Free tier runs on our bucket, and Team can run on either. “Your data never leaves your account” is true from Business up, and we will not write it unqualified.