generated: '2026-07-21'
method: searched
source: https://runway.cfo.ai/security
standards:
  - id: soc2-type-ii
    conforms: true
    evidence: >-
      Runway states it has completed a rigorous third-party SOC 2 Type II audit
      of its security practices (security page).
  - id: gdpr
    conforms: true
    evidence: GDPR compliance stated on the Runway security page.
  - id: tls-1.3
    conforms: true
    evidence: Runway states data is encrypted with TLS 1.3 in transit and at rest.
  - id: oauth2
    conforms: true
    evidence: Hosted MCP server authenticates with OAuth (browser login).
  - id: rfc9457-problem-details
    conforms: false
    evidence: Export API returns plain error messages, not application/problem+json.
  - id: iso-27001
    conforms: false
    evidence: No ISO 27001 certification stated on the security page.
compliance_program:
  certifications:
    - SOC 2 Type II
    - GDPR
  page: https://runway.cfo.ai/security
  contact: security@cfo.ai