Trust and governance
Review identity, access posture, artifact shape, and data boundaries before sending sensitive material.Review the commercial identity, access posture, artifact shape, and sensitive-data boundaries before you send architecture material or approve a larger SOW.
Current posture
Review pack before accessReview pack
AI data-flowCommercial identity, AI data-flow, BYOC access, and support checks are reviewable before deeper access.AI data-flow, BYOC access, support.
Commercial identity
Security and access
Support model
Verify identity, data boundaries, and artifact shape before sending sensitive material or signing a larger SOW.
After the evidence review
Use this point to align procurement, platform, and AI data-flow questions before sending diagrams or credentials.
The details below are designed to make the first enterprise review practical for security, risk, procurement, finance, and platform teams.
Contact data is collected only when you submit it. Architecture diagram review starts with an email request, then upload instructions are sent separately.
Access model, scope, and approvals are agreed before work starts. Production changes stay inside the client environment and change process.
AI tooling is rolled out with an operating model first: who can use it, what data may enter it, and how exceptions are approved.
Managed support uses clear severity definitions, response targets, channels, and client prerequisites rather than ambiguous availability claims.
Fixed-scope work is documented before delivery. Legal terms, IP ownership, payment terms, and privacy handling stay explicit.
RunForge does not claim SOC 2 or ISO 27001 certification. We provide evidence-ready engineering artifacts for teams pursuing those controls.
Contact data is collected only when you submit it. Architecture diagram review starts with an email request, then upload instructions are sent separately.
Access model, scope, and approvals are agreed before work starts. Production changes stay inside the client environment and change process.
AI tooling is rolled out with an operating model first: who can use it, what data may enter it, and how exceptions are approved.
Managed support uses clear severity definitions, response targets, channels, and client prerequisites rather than ambiguous availability claims.
Fixed-scope work is documented before delivery. Legal terms, IP ownership, payment terms, and privacy handling stay explicit.
RunForge does not claim SOC 2 or ISO 27001 certification. We provide evidence-ready engineering artifacts for teams pursuing those controls.
The posture stays practical: visible business details, client-owned infrastructure, documented exceptions, and artifact-based proof.
RunForge has Melbourne VIC + Driver NT, Australia business locations, operates around Australian business hours, and serves Australia, New Zealand, and APAC.
Clients keep their AWS, GCP, Azure, or selected provider accounts. RunForge does not resell cloud or hide cloud markup.
Self-hosted AI runs in Australian cloud regions by default. Provider-hosted tools or broader APAC footprints are treated as explicit exceptions.
Assessment work produces executive summaries, risk maps, roadmaps, runbooks, ownership models, and fixed-scope next options.
AI data-flow review
Inspect the default boundary first, then expand the provider exceptions and approval evidence.The first enterprise review should make hosted-provider exceptions, access model, rollback, audit logging, repo permissions, and form safety visible before sensitive material moves.
AI data-flow review
Bring provider exceptions, access, rollback, audit logging, repo permissions, or form-safety questions into the enterprise review.
Form safety: Send context only. Secrets, production tokens, credentials, and architecture diagrams move through an agreed transfer path.
AI data-flow matrix
Default boundary
Self-hosted AI workloads are scoped to Australian cloud regions in client-controlled infrastructure by default.
Provider-hosted exception
Hosted model APIs, telemetry, support access, backups, or broader APAC deployment are treated as explicit exceptions.
Approval evidence
Each exception records data categories, business owner, control owner, retention assumptions, and review cadence.
Provider tooling
Repo-local skills, evals, static checks, and Browser QA evidence stay in the client repository where practical.
Provider exception: Codex, Claude Code, Cursor, OpenCode, model APIs, or SaaS workflow tools may process prompts, repo context, diffs, logs, or telemetry depending on configuration.
Approval: Approved tools, excluded repositories, sensitive paths, and vendor settings are named before rollout.
Access, secrets, logging, rollback, and runbooks remain inside the client environment and repository.
Exception: Vendor policy controls, SSO, RBAC, audit exports, disable paths, and admin ownership are reviewed before adoption.
Approval: Security, platform, and engineering approvers agree the first pilot scope before production use.
No exception is needed when the workload, logs, and operations stay inside the agreed Australian-region boundary.
Exception: Exceptions are documented when prompts, source context, workflow payloads, telemetry, or support data can leave that boundary.
Approval: The exception register names the tool, data flow, approval owner, rollback path, and next review date.
| Area | Self-hosted / client-owned | Provider-hosted exception | Approval evidence |
|---|---|---|---|
Data | Self-hosted AI workloads are scoped to Australian cloud regions in client-controlled infrastructure by default. | Hosted model APIs, telemetry, support access, backups, or broader APAC deployment are treated as explicit exceptions. | Each exception records data categories, business owner, control owner, retention assumptions, and review cadence. |
| Area | Self-hosted / client-owned | Provider-hosted exception | Approval evidence |
|---|---|---|---|
Tooling | Repo-local skills, evals, static checks, and Browser QA evidence stay in the client repository where practical. | Codex, Claude Code, Cursor, OpenCode, model APIs, or SaaS workflow tools may process prompts, repo context, diffs, logs, or telemetry depending on configuration. | Approved tools, excluded repositories, sensitive paths, and vendor settings are named before rollout. |
Control | Access, secrets, logging, rollback, and runbooks remain inside the client environment and repository. | Vendor policy controls, SSO, RBAC, audit exports, disable paths, and admin ownership are reviewed before adoption. | Security, platform, and engineering approvers agree the first pilot scope before production use. |
Exception path | No exception is needed when the workload, logs, and operations stay inside the agreed Australian-region boundary. | Exceptions are documented when prompts, source context, workflow payloads, telemetry, or support data can leave that boundary. | The exception register names the tool, data flow, approval owner, rollback path, and next review date. |
Example artifact gallery
These labels describe the shape of work RunForge can produce. They do not imply an undisclosed client, certification, benchmark, or guaranteed outcome.
Example severity view for platform, AI data-flow, access, and ownership decisions.
Example sequence that separates useful pilots from provider, data, and support constraints.
Agent controls
Example permission matrix for tools, repos, command access, approvals, and rollback.
Data-flow exceptions
Example register for hosted providers, telemetry, model APIs, backups, and broader APAC paths.
Runbook outline
Example operating notes for deployment, disable paths, escalation, and handover.
Executive readout
Example leadership summary with decisions needed before larger programme approval.
GitOps migration plan
Example platform sequence covering repository structure, promotion, rollback, and ownership.
Example permission matrix for tools, repos, command access, approvals, and rollback.
Example register for hosted providers, telemetry, model APIs, backups, and broader APAC paths.
Example operating notes for deployment, disable paths, escalation, and handover.
Example leadership summary with decisions needed before larger programme approval.
Example platform sequence covering repository structure, promotion, rollback, and ownership.
Next sensible step
Book an enterprise review call. We'll work through your governance questions and agree what deeper access is needed before you share anything sensitive.