Security
What protects your workflows, and what doesn’t yet.
Stated as narrowly as the code allows, from v2026.10.7 (commit 9767b20f); the audit log from v2026.10.57.
- Sign-in
- With mail, no passwords: sign-in is an emailed link or code. A self-hosted install without mail uses email and password. TOTP two-factor, with ten single-use recovery codes, stored hashed. Not yet: passkeys, or two-factor an organization can require.
- Enterprise sign-in
- OIDC and SAML 2.0 single sign-on, and SCIM 2.0 user provisioning, with an Enterprise license. Not yet: sign-in started from the identity provider, or SCIM groups.
- Credentials
- Connection credentials, secret variables, model API keys and held runs’ step outputs are sealed with a per-organization key (AES-256-GCM). Ordinary run history is not encrypted by the application.
- Going live
- Publishing is its own permission, Publish and unpublish. A token without it can draft and test, but can’t publish.
- Tokens
- Scoped API tokens, stored hashed, with optional expiry. You can only grant permissions you hold.
- Audit log
- Every credential decryption, sign-in, OAuth consent, member or role change, SSO setting, token created or revoked, workflow edit, platform-admin action and Keel apply is written to an audit log you can read in the dashboard, export as CSV or stream to your own tools. On Cloud, credential use by runs, schedules and polls is kept for 90 days, and each connection’s latest use for longer; a person’s actions and security events are kept for 2 years, with IP addresses removed after 90 days. A self-hosted installation keeps everything until you set a retention.
- Self-hosted
- No telemetry, no license phone-home, no update check.
- Certifications
- None yet. GoRunner has no SOC 2 or ISO 27001 report today.
- Report a vulnerability
- security@gorunner.io