Skip to content
runline
Try the demo
FeaturesHow it worksLibraryLive DemoPricingSecurityContact
Workspace

Draft DPA and security one-pager

Runline Labs, Inc. processor terms for campus and biotech evaluation. Last updated 2026-10-17. This is a draft template — not attorney-approved. Print this page and save as PDF to download it.

Counsel review — not legal sign-off. Not a signed DPA, SCCs, HECVAT, or SOC 2 letter. Public claim IDs: CMP-015–CMP-023 in the comparison-marketing claims register.

Roles

The customer (university, lab, or company) is the controller of User Content they put in runline. Runline Labs, Inc. is the processor for that workspace data. We do not use User Content to train foundation models. This page is not a signed DPA, Standard Contractual Clauses, or a HECVAT response.

Draft processing terms

  • Subject matter: account, lab workspace, and feature data needed to operate the service under the customer Terms.
  • Duration: subscription / workspace term plus the published retention schedule.
  • Subprocessors: listed below and on Privacy. International transfer tools are not counsel-signed on this page.
  • Assistance: self-serve ZIP export (JSON / Markdown / BagIt) and account deletion paths are on Privacy and Settings. Breach and audit language wait for counsel.

Security one-pager

  • Storage and lab-scoped RLS. TLS in transit and AES-256 at rest on the hosted store. Lab-scoped tables use Row-Level Security. Lab files on Supabase Storage support upload, download, and preview. The shared reagent catalog is not tenant-isolated.
  • Tamper-evident audit chain. Lab audit events append through a hash-chained trail. Review can show chain verification and export CSV with chain status. Daily chain anchors and optional RFC 3161 timestamping depend on ops configuration — not a regulated Part 11 attestation.
  • E-signature and sign lock. Operator Sign & Lock binds a re-authenticated meaning and content hash on a run; edits after signing are detectable. Optional witness attestation is available. This is not a Part 11 / QES / ALCOA+ certification.
  • Full export in open formats. Self-serve Settings export: JSON and Markdown records plus byte-exact Storage files in a BagIt ZIP (SHA-256 manifest). Rate-limited; large exports use a short-lived signed download URL.
  • Self-serve account deletion. Account deletion is available in Settings / Privacy. Personal data is purged on the published retention schedule (verified deletion aim ≤ 30 days unless legal hold). Lab-owned content stays with the lab where the schedule says so.
  • Campus SSO is available on request per institution. No identity provider is registered yet — sign-in is Google or GitHub OAuth, or email. (CMP-021)
  • SOC 2 Type II is coming soon. An observation period has not started and we do not have an auditor letter. (CMP-022)
  • Optional analytics (PostHog US via first-party /ingest) load only after cookie accept and never under Global Privacy Control.
  • We do not train models on your content. Our AI providers process requests under their commercial API terms. Not a zero-data-retention certificate.

Your data stays yours

You keep ownership of User Content you put in runline. Export and deletion paths are self-serve. We do not use User Content to train foundation models under the paid AI configuration (see /ai).

  • Full export in open formats (ZIP / JSON / Markdown / BagIt).
  • Self-serve deletion via Settings and Privacy.
  • If a paid plan ends — draft export window: 30 days (CMP-019). Owner approval pending — not a contractual SLA.

Subprocessors

  • VercelHosting, edge network, and optional first-party web analytics (only if you accept optional cookies).
  • PostHog (US)Optional product analytics, feature flags, error tracking, and in-product surveys (only if you accept optional cookies; never when Global Privacy Control is on). Browser traffic is proxied through /ingest on our domain so the browser talks to runline.space, not a third-party analytics host.
  • DubOptional referral and ambassador short links (go.runline.space). Created only when you click Get referral link / Ambassador link — never emailed to contacts automatically.
  • SupabaseAuthentication, Postgres, and file storage for cloud workspaces.
  • Anthropic, PBCPrimary AI model provider when AI is enabled (Claude Haiku 5.5 / Sonnet 5.5 via the Anthropic API), including Anthropic's server-side web search tool for community search when that feature is on.
  • Google (Gemini / OAuth)Optional Google sign-in; when AI features are on, the paid Gemini API for AI fallback, Justin chat, literature answers, OCR, grant mock-review, and live voice (Gemini Live audio).
  • LangfuseOptional AI call tracing and cost metering when LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY are configured (server-side OpenTelemetry exporter).
  • GitHub OAuthOptional GitHub sign-in.
  • StripeTest-mode checkout, subscriptions, and Customer Portal for Individual Pro and Quantify trials (no live charges in this phase).
  • ResendTransactional email (notebook invites, run-report shares).
  • FormspreeContact / deletion request form delivery.
  • Upstash RedisOptional API rate limiting and AI daily quotas.
  • LiveKitOptional voice / realtime rooms when Copilot voice is enabled.
  • Hugging Face Spaces (proxied)Server-side diagnostics / bioquant / quant engines when configured.
  • Cloudflare TurnstileOptional CAPTCHA on sign-in / create-account, contact, and deletion forms when configured.
  • OpenAlexLiterature search and open scholarly metadata when you run Analyzer / literature queries.
  • Europe PMCLiterature search and full-text retrieval for open-access Europe PMC records.
  • NCBI / PubMedLiterature search via NCBI E-utilities (PubMed), BLAST sequence search, and PubChem compound lookup (PubChem is called from your browser) when you use those features.
  • Semantic ScholarLiterature search and paper graph metadata via the Semantic Scholar API.
  • CrossrefDOI resolution and bibliographic metadata for citations you look up.
  • arXiv, bioRxiv / medRxiv, ClinicalTrials.govPreprint and trial-registry search when you run literature queries.
  • UniProt, AlphaFold DB (EMBL-EBI), RCSB PDBProtein, structure, and sequence lookups from the connectors you use.
  • SciCrunch (RRID resolver)Antibody and reagent RRID checks when you verify a lab index entry.
  • protocols.ioProtocol search and import when you use the protocols.io import.
  • ZoteroOptional reference sync when you connect your Zotero library.
  • RSpace (your instance)Optional ELN import from an RSpace server URL you enter.
  • Cloudflare cdnjs / Hugging Face HubStatic viewer images for the deep-zoom image viewer, and on-device speech model files when local speech-to-text is enabled (both loaded by your browser).
  • Operator-configured endpointsOnly when an operator configures them: a Rocket.Chat server for lab messaging, a feedback webhook, and an RFC 3161 timestamp authority for audit-chain anchors.

Questions: support@runline.space · Security · Campus

Accessibility statement