Runway has achieved ISO/IEC 27001 certification for its information security management system, adding to its existing SOC 2 Type II compliance as the AI video company strengthens enterprise security credentials.

The certification validates Runway's security controls through independent auditing by an accredited certification body. The company maintains both certifications to demonstrate ongoing security excellence for enterprise customers using its AI-powered video creation and editing tools.

Enterprise Security Framework

Runway's security program includes comprehensive workforce screening with background checks covering criminal searches and watchlist verification for all new hires. The company requires binding confidentiality agreements from employees and contractors handling customer content.

The platform implements role-based access controls following least privilege principles. Production environments require multi-factor authentication through single sign-on systems, while automated deployment pipelines minimize direct human access to sensitive infrastructure.

Customer content receives AES-256 encryption at rest with protected key management and regular rotation schedules. All data transmission uses TLS 1.2+ with strong cipher suites for transit protection.

Compliance and Monitoring

The company aligns with GDPR requirements for European users and CCPA/CPRA protections for California residents. Comprehensive logging systems track infrastructure access, with security teams reviewing logs for suspicious activity and unauthorized access attempts.

Runway maintains automated backup procedures with regular restoration testing and defined retention schedules. The company honors customer data deletion requests according to contractual obligations and data minimization principles.

Enterprise customers can access SOC 2 Type II reports and ISO 27001 certificates through Runway's Trust Center. The company publishes a current subprocessor list for transparency regarding third-party data handling.

Runway's vendor management process includes detailed security evaluations and formal contracts requiring data protection compliance from all service providers supporting platform operations.