Skip to main content

Security

This section details the security measures we’ve implemented for the RunJob service.

Product Security Features

RunJob implements enhanced security measures to protect the environments in which your jobs and runners do operate:

  1. Source Code Security: We ensure that all communication with the version control system to access source code is encrypted using SSH and/or HTTPS.

  2. Dynamic KVM Allocation for Jobs: Each job is executed within its own dynamically spawned Spike Instance, starting from a clean state. This ensures complete isolation and a secure, controlled environment for every job.

  3. Environment Variable Encryption: All environment variables used within your jobs are encrypted in-flight before they enter the isolated Kernel-based Virtual Machine (KVM). This ensures that they are never stored unencrypted outside of the memory.

  4. Network Isolation: Each runner and each job is isolated not only from external networks but also from each other, ensuring no cross-access or interference.

  5. No Storage of Standard Output: The standard output (stdout) of jobs is not stored, maintaining the confidentiality of the runtime data.

  6. Ephemeral Filesystem: Our system uses an ephemeral filesystem during runtime. This filesystem is completely erased after the job's completion, preventing any accidental data storage.

  7. OpenID Connect: Our system supports authentication via OpenID Connect, allowing secure access control to all user resources.

Network Security

Security architecture of RunJob includes multi-layered defense mechanisms, such as firewalls, isolated networks, and segregated Kubernetes clusters. These isolated clusters enhance the security of our containerized applications by providing an additional layer of isolation and control.

Data Security

  1. EU GDPR Compatible: RunJob is fully compliant with the General Data Protection Regulation (GDPR), ensuring the highest standards of user data privacy and security. For more details, please refer to our Data Processing Terms.

  2. Configuration Policies: We enforce strict organizational compliance limiting as much as possible the amount of employees which have access to user workloads and data.

  3. Secure Data Transfer: All data in transit is encrypted using industry-standard protocols.

  4. Encrypted Sensitive Data: The content of all Secrets is encrypted.

  5. Isolated Data Storage: RunJob implements stringent isolation measures for persistent data storage, ensuring that data at rest is also securely segregated and protected against unauthorized access or breaches.

Development Security

RunJob's development practices are designed with a strong focus on security, encompassing multiple layers of safeguards:

  • Secure Coding: Our developers strictly adhere to secure coding standards, aiming to minimize vulnerabilities right from the development phase.

  • Controlled Release Process: Each release undergoes a thorough review and control process. This ensures that only secure, vetted changes are deployed into production, reducing the risk of introducing potential security issues.

  • Application-level Security Testing: We conduct rigorous testing against common security risks, ensuring our applications are resilient against a wide range of vulnerabilities.

Certification

RunJob is SOC 2 Type II compliant, demonstrating that our controls for security, availability, and operational processes have been independently assessed over time. This helps ensure that customer data is protected through documented policies, access controls, monitoring, encryption, and ongoing security practices. Our SOC 2 report is also available upon request.

Reporting Security Concerns or Incidents

At RunJob, we encourage reporting of any security concerns or vulnerabilities and strive to resolve them at the high priority level for prompt action.

To report an issue or incident:

  1. Immediate Notification: Contact us immediately at security@runjob.eu with a detailed description of the issue.

  2. Responsible Testing: Please conduct any testing against simulated or fake data and accounts. Avoid using real user data. If necessary, request a test account from us.

  3. Collaborative Resolution: Work with our team to understand and remediate the vulnerability before any public disclosure, to ensure the protection of all users' data.

Please note that RunJob does not operate a bug bounty program. We do not offer financial rewards for vulnerability disclosures. However, we value your contributions towards enhancing the security of our ecosystem and encourage responsible reporting practices.