Privacy & Security
Runless is designed with privacy and security as core principles. This page explains what data we access, how we protect it, and your controls.
What We Access
From GitHub
Runless uses two GitHub integrations with different permission models:
GitHub App (for real-time webhooks):
| Permission | Level | What We See |
|---|---|---|
| Actions | Read | Workflow run metadata, job names, step names, durations |
| Metadata | Read | Repository names, workflow file paths |
OAuth App (for sign-in and API access):
| Scope Level | What It Enables |
|---|---|
| Identity | Sign in, add public repos |
| Repository | Add private repos, read workflow files |
| Workflow | Create fix PRs for workflow files |
We use progressive permissions — you start with minimal access and grant more only when needed. See GitHub Permissions for full details.
What We DO NOT Access
We never see your source code, pull request content, issues, secrets, or any repository content.
Specifically, we cannot access:
- Source code or file contents
- Pull request descriptions or comments
- Issues or discussions
- Repository secrets or environment variables
- Deployment targets or credentials
- Commit messages (beyond metadata)
Data We Store
For each workflow run, we store:
| Data | Example |
|---|---|
| Run ID | 1234567890 |
| Workflow name | CI |
| Workflow path | .github/workflows/ci.yml |
| Status | completed |
| Conclusion | success |
| Duration | 245 seconds |
| Started/completed times | ISO timestamps |
| Trigger event | push |
| Branch | main |
| Commit SHA | abc123... |
| Actor | username |
We do NOT store:
- Log contents
- Artifact contents
- Environment variable values
- Secret values
Data Location
- All data is stored in the United States
- Database: PostgreSQL on managed infrastructure
- Backups: Encrypted, retained for disaster recovery
Security Measures
Infrastructure
- HTTPS everywhere (TLS 1.2+)
- Database encryption at rest
- Network isolation between services
- Regular security updates
Authentication
- OAuth 2.0 via GitHub
- No passwords stored
- Session tokens with expiration
Webhook Security
- Signature verification (HMAC SHA-256)
- Webhooks rejected if signature invalid
- Rate limiting on ingestion
Access Control
- Role-based access within teams
- Audit logging for sensitive actions
- No shared credentials between customers
Your Controls
Revoking Access
To stop Runless from accessing your repositories:
- Go to GitHub Settings → Applications → Installed GitHub Apps
- Find Runless and click Configure
- Click Uninstall
This immediately stops webhook delivery and API access.
Data Deletion
To delete your data:
- Go to Runless Settings
- Delete your team
- All associated data is permanently removed
Or contact [email protected] for assistance.
Data Export
Data export is planned for a future release. Contact support if you need an export before then.
Compliance
Runless is designed to be compatible with:
- SOC 2 Type II (certification in progress)
- GDPR (data processing agreement available)
- CCPA (California Consumer Privacy Act)
For enterprise compliance requirements, contact [email protected].
Reporting Security Issues
If you discover a security vulnerability, please report it to [email protected]. We take all reports seriously and will respond within 24 hours.
Do not disclose security issues publicly until we've had a chance to address them.