Security & Data Handling
How Run-Via handles your data
This page summarizes our security practices and data handling policies. Save or print it for your procurement or IT team.
Data encryption
- All data encrypted in transit via TLS 1.2+
- Database encrypted at rest using provider-managed keys (AES-256)
- File attachments stored in encrypted object storage (S3 with server-side encryption)
Authentication
- SSO via SAML 2.0 — connect your existing identity provider
- Two-factor authentication (TOTP) available for all accounts
- Server-side session management with configurable timeouts
- Password hashing using bcrypt with per-user salts
Access control
- Strict tenant isolation — each organization data is completely separated
- Role-based access control (RBAC) with granular permissions per team
- All database queries scoped to the authenticated tenant
- Token-based guest links provide read-only access without accounts
Compliance
- Immutable audit log recording every create, update, and access event
- Audit export to CSV and JSON for external review
- Configurable data retention policies per organization
- Full data export available on request for portability
Infrastructure
- Hosted on Fly.io with automated deployments and health checks
- PostgreSQL 15 database with automated daily backups
- Redis for session storage and background job processing
- Error monitoring via Sentry; metrics via Prometheus
- Public service-status page for live health signals
What we do not do
- We do not sell your data to third parties
- We do not use third-party analytics or tracking scripts
- We do not mine your data for advertising or profiling
- We do not share data between tenants under any circumstances
Support & policies
- Support contact: run.via.support@gmail.com
- Refund policy: Read the full refund policy
- Availability target: 99.9% with health checks and service-status visibility. Contractual uptime guarantees apply only when included in a signed agreement.
Print this page or save as PDF for your procurement team.