Security & data
Clear about where your numbers go.
Financial data deserves precise language. This page describes how the service is built today, without certifications or promises we cannot back up.
Hosted processing, stated plainly
- Goodrun is a hosted cloud service. Your reports and figures are processed and stored on servers we operate with our infrastructure providers, not only on your computer.
- Connections use encrypted HTTPS in deployed environments. Provider credentials are kept server-side and are never sent to your browser.
- We do not claim end-to-end encryption or zero-knowledge storage: Goodrun’s servers need to read your data to calculate revenue, payouts and cash plans.
A separate database for each organization
- Each Goodrun organization’s financial data lives in its own dedicated database rather than in tables shared with other customers.
- Every request is checked on the server: your session, your membership, the organization’s database, then your access to the specific game.
- Jobs, files, exports and reports follow the same boundary. An identifier sent by a browser is never trusted on its own.
Roles and per-game access
- Owner, Admin, Editor and Viewer roles, plus a separate billing permission.
- Members can be limited to specific games. Totals, exports and portfolio views only include the games they are permitted to see.
- Removing a member revokes their access. Scheduled report emails, once available, re-check who may receive them at delivery time.
Your data stays yours
- Export is included in every plan, including Indie.
- Cancelling a subscription does not delete your organization’s data. Deletion is a separate, deliberate request.
- Your data is not used for cross-customer benchmarks or model training without a separate, explicit agreement.
Explicit AI choices
Beta
- AI analysis is optional. Every financial feature works without it.
- When it ships, you choose whether to use it and can see which provider receives data. A provider is never switched silently.
- Imported files, campaign text and links are treated as data. They cannot change permissions, recipients or tools.
- The model has no direct database access. It works through a small set of read-only, permission-checked tools.
Sign-in and identity
- Sign-in is handled by a hosted authentication provider. Goodrun never stores your password.
- Sessions use secure, HTTP-only cookies, and actions that change data are protected against cross-site requests.
- Enterprise single sign-on Setup pending
What we do not claim. Goodrun does not currently hold security certifications, and this page does not promise a hosting region or contractual response times. Those will only be stated once they are in place and in writing.
Security question or report? Use the channel on our contact page. See also the draft privacy notice.