Security & trust
What we do, and what we are not going to claim.
Security pages usually list certifications. Below is what is actually implemented, followed by a plain statement of what Runner does not yet hold, because the second list is the one that matters in a procurement review.
Access
Who can see what, and how that ends when they leave.
- Roles
- Admin, branch manager, order operator, sales rep and driver. Each person sees the sites and the work their role allows.
- Site-scoped
- A person is granted the specific sites and depots they work at, not the whole business by default.
- Revocation
- Removing someone removes their access everywhere at once, including the app on their own phone.
- One Runner account
- The same sign-in as the rest of the Runner platform: email and password, or a one-time code by phone.
Data
Where it sits and who can reach it.
- Tenant isolation
- Every read is scoped to the business it belongs to, enforced on the server rather than by the client asking nicely.
- Transport
- TLS everywhere, including between the app and the sync service.
- Hosting
- United Kingdom and European Union regions. Tell us if you have a residency requirement and we will confirm in writing.
- Retention
- Records are kept for the period the sector requires; deletion of a business removes its data on request.
Verification
Trust between buyer and supplier, on the record.
- Business files
- A buyer's business is checked once, against public registers where they exist, with trade references and guarantees, and kept as verdicts rather than raw reports.
- Shared on purpose
- A buyer shares their file with one supplier for one purpose, and can withdraw it.
- One redaction point
- Everything a supplier sees of a customer passes through a single point, so nothing leaks by accident.
- Access log
- Every look at a customer's file is logged, and the customer can read that log.
Operations
How changes reach production.
- Rate limiting
- Per user and per endpoint, on the routes worth abusing.
- Bot protection
- Sign-up, sign-in codes and public forms are protected against automated abuse.
- Audit trail
- Every order keeps a timeline of each change in plain words, with where it came from and who placed it.
- Change control
- Every schema change ships as a reviewed migration applied by the deployment, not by hand against a database.
What we do not claim
The honest list.
Certifications Runner does not currently hold
Runner has not been certified to ISO 27001, SOC 2 or Cyber Essentials Plus. Any vendor questionnaire asking for those will get that answer from us in writing rather than a qualified one.
What we will provide: a completed security questionnaire, our sub-processor list, a data processing agreement, and a named contact for incidents. If certification is a procurement requirement for you, say so early. It changes the timeline, and we would rather tell you that at the first meeting than the fifth.
The full documents
Policies live on the Runner site.
One company stands behind every Runner product, so the security detail and the legal documents are published once, on runnerapp.io.
Send us the questionnaire.
Security questionnaires, data processing agreements and sub-processor lists are answered by the people who build the platform.