Security
Runwei™ holds the financial journey of entrepreneurs who have often been underserved by institutions. They trust the platform with that data, and institutions rely on it as evidence. Both depend on the controls below.
Compliance status
Runwei™ operates SOC 2-aligned controls. We are not yet audited or certified, and we say so plainly. An attestation path is part of our current security program.
Controls
Verified in code, not in slideware. These are the controls the platform runs every day.
Passwords are stored only as bcrypt hashes. All traffic is encrypted in transit over HTTPS. Field-level encryption for sensitive profile data is on our security roadmap.
Signed access tokens that expire after 24 hours, with server-side session revocation, so a session can be ended immediately.
Access is enforced at the API by role: entrepreneur, partner, and administrator each see only what their role allows.
Browser clients and extensions never carry service credentials. Calls go through server-side proxies that check who is calling before anything is forwarded.
Administrative actions and record changes are logged. Nothing unreviewed is ever published to end users.
Sign-up and contact forms are protected against automated abuse, disposable addresses, and repeated attempts.
Data stewardship
To report a vulnerability or request a security review, use the contact form and mark the subject Security.
Primary CTA
Institutional security reviews receive an architecture overview with trust boundaries, a control inventory, and sanitized configuration on request.