Privacy Policy

When the SafeRun SDK is wired into your agent, we receive the data needed to validate, replay, and prevent failures:

• Agent actions: the tool calls your agent attempts — tool name, arguments, policy decision, result, latency, and cost.
• Replays: the frame-by-frame timeline of an agent run — model output, retrieved context, plan, and external state at the moment of each decision.
• Decision context: the inputs available to the agent when it chose an action, captured at decision time (not reconstructed afterward).
• Workspace metadata: account email, workspace name, API key identifiers, and audit log of who changed what.

We do not sell data, and we do not use customer agent data to train third-party models.

• Data is stored in a managed Postgres database (Supabase) with encryption in transit (TLS) and at rest.
• Sensitive fields in tool arguments and results are redacted by default before they reach our storage. You control the redaction rules per workspace.
• Access to production data is restricted to a small set of SafeRun staff and logged.

SafeRun is early-stage. We do not currently hold SOC 2, ISO 27001, HIPAA, or GDPR certifications. If your use case requires one of these, contact us before integrating.

• Free plan: action logs and replays retained for 7 days, then deleted.
• Paid plans: retention configurable per workspace, up to the limit of your plan.
• Account deletion: on request, we delete your workspace data within 30 days. Backups are purged on their normal rotation (no later than 90 days).

We rely on the following infrastructure providers:

• Supabase — managed Postgres, authentication, and storage.
• Cloudflare — edge compute and CDN.

You can request a copy of your workspace data, correction of inaccurate data, or deletion of your account at any time by emailing hello@saferun.dev.

Questions about this policy? hello@saferun.dev

SafeRun Labs, Inc.