The data processing addendum, privacy policy and subprocessors page say more, and say what is true today

A new subprocessor is listed at least 30 days before it starts, and you may object within those 30 days; email legal@withruntime.com to be told when the list changes. A breach affecting your data is reported to your account's owners within 72 hours, with what happened, who and what it touches and what we are doing. Closing an organization destroys its key first, then deletes its data, and the addendum gives every step's time limit, including each server's own nightly backup, gone within 44 days. Once we hold a SOC 2 report, it is shared under a confidentiality agreement as our answer to audit requests. The addendum lists the security measures we run now. Anthropic, which runs the AI model that answers support, and Slack, which carries our team's alerts and support drafts, are now on the subprocessors page. See security and compliance.