RuntimeGuard is a security product — so we hold ourselves to a high standard when it comes to protecting your data, your infrastructure, and the trust you place in us.
All data between your agents and our API is encrypted using TLS 1.3. We enforce HTTPS on all endpoints. Plaintext connections are rejected. API keys are transmitted via secure headers, never in query strings.
Event data and incident records are stored in encrypted volumes. Database-level encryption is applied to all sensitive fields including API keys (stored as bcrypt hashes) and tenant credentials.
Every API request requires a valid API key scoped to a single tenant. Admin operations require a separate admin secret. Rate limiting (100 req/min) prevents brute-force and abuse. Keys can be revoked instantly from the dashboard.
Each tenant's data is fully isolated at the storage layer. Tenant IDs are validated server-side on every operation. It is architecturally impossible for one tenant to query another's events or incidents.
The eBPF agent collects only what is necessary for detection: process names, file paths, event timestamps, and PIDs. It does not collect file contents, memory dumps, network traffic, or credentials. You always own your data.
eBPF programs are verified by the Linux kernel before execution. They cannot crash the kernel, cannot access arbitrary memory, and are restricted to the specific tracepoints they are attached to. The agent requires root to load eBPF, but runs with minimal capabilities thereafter.
Send a detailed report to our security team. Include a description of the vulnerability, steps to reproduce, potential impact, and any proof-of-concept code you have developed. We will acknowledge receipt within 24 hours.
Contact: security@runtimeguard.io
For sensitive disclosures, request our PGP key in your initial message and we will respond with an encrypted channel.
Within 24 hours of your report we will send you a confirmation that it has been received and is being reviewed by our security team.
We assess the validity and severity of the finding. We will communicate our assessment to you and discuss any questions we have about reproduction or impact.
Our team will develop and deploy a fix within the SLA for the severity level. We will notify you when the fix is live and provide the opportunity to verify the patch.
After the fix is deployed, we are happy to support a coordinated public disclosure at a time agreed with the researcher. We will credit you in our security advisory unless you prefer to remain anonymous.
We commit to not pursuing legal action against researchers who discover and report vulnerabilities in good faith, without accessing customer data or causing service disruption.
Contact our team directly. We respond to all security-related enquiries promptly.