We hold ourselves to the standard we ask of you.

• Connection secrets are stored through an encrypted vault (AES-256-GCM), with a separate encryption key derived per tenant: never in plain text, never logged, never returned to a browser.
• Every tenant-scoped table has row-level security policies and explicit database grants; tables holding secrets, webhook events and monitoring credentials are locked to service-role access only, with zero client-facing policies.
• Every signature check (webhook verification, token comparison) uses a timing-safe comparison, so a mistimed guess can't leak information bit by bit.
• Background jobs are idempotent: a webhook is only ever acknowledged once the work it triggered is verifiably done, and failures are recorded, never silently dropped.

• Every connection uses least-privilege, read-only tokens: we ask for only the access a check actually needs.
• Every token is validated with a real read before it's stored, so a broken or over-scoped credential is caught immediately rather than failing silently later.
• Any outbound request we make to a web address you give us (for detection) goes through an SSRF-safe fetcher, never a raw request, so your assessment can't be turned into a tool against your own or anyone else's internal network.
• Your code repository stays read-only. We never write to it, and access can be revoked by you at any time.

If you believe you’ve found a security issue in RunAssured itself, email security@criticalcloud.ai. We investigate every report and will not take legal action against good-faith, non-destructive security research.

Report a security issue

Row-level security coverage, committed and browser-exposed secrets, dependency vulnerabilities, backup and recovery, network-edge settings, and email authentication are among the checks RunAssured runs on the app you’re onboarding.

See everything the assessment checks →