Your event data, protected and in your control.
Guest lists, contracts and budgets are sensitive. RunCue keeps each workspace separate, shows each person only what their role needs, and lets you take your data with you.
Example: a planner sees the whole event record; a client sees only proposals, invoices and files shared to their portal; a vendor sees only their own booking, call sheet and the files marked visible to them.
How RunCue protects your data
Sign-in and two-step verification
Sign in with email and password, a magic link, or company SSO where it is set up. Anyone can turn on two-step verification with an authenticator app. Sessions last up to 14 days, and owners on team plans can shorten that to 1, 3 or 7 days for their workspace.
Access control by role
Every person has a role in the workspace and on each event, and sees only what that role needs. A caterer sees their requirements, not your budget. Clients and vendors sign in to their own portals, which do not take a workspace seat. RunCue checks permissions on the server for every protected action.
Tenant isolation between workspaces
Each workspace’s records are kept apart by database row-level security, so one workspace can never read another’s data. Private files are only available to people with access to them.
Encryption in transit
All traffic between your browser, RunCue and the services it uses is encrypted with HTTPS. Card details for your RunCue subscription are handled by Stripe and never stored by RunCue.
A full history of changes
Important changes are recorded with who made them and when, so you can see who changed a task, approved a quote or moved a cue.
Export and deletion
Workspace owners can export the workspace’s data at any time. Deleting a workspace starts a 30-day grace period: the workspace becomes read-only, every member is told, and an owner can cancel the deletion. After that it is permanently removed. A deleted event can be restored for 30 days, and once an event is over its owner can remove guests’ personal details while keeping the results.
Sub-processors
Services RunCue relies on
These services process data so RunCue can provide the features described. See the full subprocessor list and our Data Processing Addendum.
| Service | What it is used for |
|---|---|
| Supabase | Database, sign-in, private file storage and server functions. |
| Vercel | Hosting and delivery of the RunCue web app. |
| Stripe | Subscription billing and payments. Card details stay with Stripe. |
| Resend | Sending email, such as invitations and notifications. |
| Twilio | Sending and receiving SMS messages from the shared inbox. |
| Anthropic | The Ask Cue assistant, which answers questions from event data you can access. |
| OpenAI | Reading uploaded documents you choose to import, such as contracts and briefs. |
| Cloudflare | Bot protection on public forms. |
Security questions
- Where is my event data stored?
- In the European Union. RunCue’s database and private files are hosted by Supabase in the AWS Ireland region, protected by row-level security so each workspace’s records are kept apart.
- Do you store payment card numbers?
- No. Card details for your RunCue subscription are handled directly by Stripe and never stored by RunCue.
- Can I get my data out?
- Yes. Workspace owners can export a structured copy of the workspace at any time.
Responsible disclosure
Found a security issue?
Email us with the subject line “Security”. Please give us a reasonable time to investigate before sharing it publicly.