How Runway protects your plan

Eisenlabs LLC designed Runway to minimize the information it collects and keep plan access tied to an authenticated cloud account.

Cloud storage

Plan data is stored in Supabase rather than browser application storage. Database row-level security restricts each signed-in user to their own plan. Concurrent changes use conflict detection to reduce accidental overwrites.

Authentication

Supabase Auth manages password hashing, sessions, password recovery, and account identity. Runway never receives or stores plaintext passwords on its own servers.

Application safeguards

Runway uses HTTPS, restrictive content-security and framing policies, authenticated server endpoints, webhook signature verification, input limits, and sanitized AI context. Server-side credentials are never embedded in browser code. Optional passkey sign-in uses WebAuthn: biometric or device-PIN verification stays on your device, while Supabase stores the public credential needed to verify sign-in.

Financial access

Runway does not currently connect directly to bank accounts and does not request bank usernames, passwords, or account numbers. CSV statement imports are processed transiently in the browser; confirmed updates are then written to your cloud plan.

Responsible reporting

If you believe you found a vulnerability, email security@eisenlabs.io. Do not access, change, retain, or disclose another user’s data. Include enough detail to reproduce the issue without including sensitive user information.

Limitations

No system is immune from risk. Users should use a unique password, protect their email account, keep devices updated, and report unexpected account activity promptly.

Before public launch, Runway will complete an independent review of database policies, account deletion, backup restoration, dependency security, and incident response.