This page explains who is responsible for what when you use Createrun, what Createrun's own controls are designed to do, and how to report a security problem. It describes our practices. It is not a contract, and it does not change the terms of your agreement with us.
Shared responsibility
Who is responsible depends on how you use Createrun. If you run Createrun on your own servers, you operate and secure the whole environment. If we host an instance for you, we share the work. For development services and Store items, you remain responsible for what you build, install and publish.
On a self-hosted instance, the application runtime and process engine run on your servers. Activation and package downloads connect to Createrun. External AI providers and business integrations are separate connections that your team chooses and reviews.
Area
Responsibilities by service line
| Area |
Self-hosted |
Createrun Cloud and rented VMs |
Development services |
Store items |
| Infrastructure |
You: servers, storage, data center or cloud account. |
Createrun: physical hosts, storage and the virtualization layer. |
Createrun: the infrastructure that runs the hosted development tools. |
You: the infrastructure you install the item on. Publisher: any service the item connects to that the publisher runs. |
| Operating system and patching |
You: operating system, runtime and database server updates. You decide when to apply Createrun updates. |
Createrun: the operating system and runtime of Createrun-managed instances. You: rented VMs where you have administrator access. You decide when to apply application updates unless your order says otherwise. |
Createrun. |
Publisher: fixes to the item. You: applying item updates. |
| Network |
You: firewalls, load balancers, certificates, DNS and remote access. |
Createrun: the network up to your instance. You: which users, systems and integrations you allow to connect. |
Createrun: network controls for the hosted tools. You: the networks and devices you connect from. |
You: which outside services you allow the item to reach. |
| Application code |
Createrun supplies the platform and generated application DLLs. You retain project files and custom source that your team or its AI authors, and review the applications you deploy. |
Createrun supplies the platform and generated application DLLs. You retain project files and custom source that your team or its AI authors, and review the applications you deploy. |
You: your code, models, workflows and repositories, and reviewing and testing any AI-generated output before you use it. |
Publisher: the item's code. You: deciding whether to install it and how to configure it. |
| Data |
You: all data. Createrun does not receive your application data. We receive only the account, licensing and update information described in our Privacy Policy. |
You: what data you store, who can see it and whether you are allowed to keep it. Createrun: protecting the hosting environment it sits in. |
You: project content and repository content. Createrun: protecting the service that stores it. |
You and the publisher, under the publisher's terms and privacy policy. |
| Identities and access |
You: user accounts, roles, directory connections and administrator credentials in your instance. |
You: users, roles and credentials in your instance. Createrun: its own staff access to the hosting environment. |
You: your Createrun account, your organization's members and any AI client or tool you connect with your credentials. Actions taken with your credentials are your actions. |
You: the permissions you grant the item. |
| Backups |
You: all backups and disaster recovery. |
Createrun takes backups of hosted instances as described under "What Createrun does". These are not a guarantee. Keep your own copies of anything you cannot afford to lose. |
You: keep your own copy of your repositories and exports. |
You: backups of the data the item stores. |
| Compliance |
You: any legal, regulatory or industry requirement that applies to your applications and data. |
You: requirements that apply to your applications and data. Createrun: its obligations under your agreement and our Data Processing Addendum. |
You: requirements that apply to what you build and deploy. |
Publisher: its own obligations. You: whether the item is suitable for your use. |
What Createrun does
The controls below are designed to reduce risk. No system is completely secure, and we do not promise that the services will be free of vulnerabilities or interruptions.
Signed packages and updates
Platform releases, application packages and Store items are designed to be cryptographically signed. The installer and the update process are designed to check signatures and download integrity before anything is installed, and to reject packages that fail those checks. A self-hosted instance pulls updates; you decide when to apply them. A Store listing or approval signature is not a security audit of the item's code.
Account security
Createrun accounts are managed by our identity service. It is designed to store passwords only as salted hashes, to lock an account temporarily after repeated failed sign-ins, and to let you see and revoke your active sessions. We will never ask for your password by email.
Encryption in transit
Our public services are designed to accept connections only over TLS. Self-hosted instances can be configured the same way; configuring certificates on your own servers is your responsibility.
Access control
Users and data in the platform are scoped by organization, and access is checked on each request. Administrators assign roles within their organization. Inside Createrun, access to production systems is limited to staff who need it for their work.
Logging
Our services are designed to record security-relevant events such as sign-ins, failed sign-ins, lockouts and role changes. Self-hosted instances do not send operational logs to Createrun unless you turn that on.
Backups for hosted instances
For Createrun Cloud and rented VMs, we are designed to take backups to physically separate hardware in the same data center. Backups are an operational measure, not a guarantee that any particular data can be restored. Keep your own copies.
Vulnerability handling
We review reported and discovered vulnerabilities, prioritize them by severity and release fixes for supported versions. We describe security fixes in release notes when doing so does not put customers at risk.
Where we host
Createrun is based in the United States. We process data on servers operated by us or our service providers, primarily in the United States. Where data of users in other regions is transferred, we rely on appropriate safeguards as required by applicable data protection laws. For the third-party providers we use, see Subprocessors.
If you run Createrun on your own servers, your data stays where you put it.
Certifications
Createrun holds no third-party security certification or audit attestation today. If your review needs more detail, write to security@createrun.com and tell us which version and deployment model you plan to use.
Reporting a vulnerability
If you think you have found a security vulnerability in Createrun, email security@createrun.com. Please include:
- the affected product, URL or version;
- steps to reproduce the issue;
- what an attacker could do with it;
- how to contact you.
We will acknowledge your report, keep you informed while we investigate, and tell you when it is fixed. We do not commit to a fixed response time.
Good-faith research
We will not pursue legal action against research that follows these guidelines:
- Test only against accounts and instances you own or have permission to test.
- Do not access, change or delete other people's data. If you reach it by accident, stop and tell us.
- Do not run denial-of-service tests, spam, social engineering or physical attacks.
- Do not test Store items against their publishers' systems. Report issues in an item to its publisher, and copy us if you think the item puts other customers at risk.
- Give us reasonable time to fix the issue before you share details publicly.
We do not run a bug bounty program and do not pay for reports.
Security incidents
If we become aware of a security incident that affects your data in a Createrun-hosted service, we will notify affected customers without undue delay where required by law or by our agreement with you. We will share what we know, what we are doing about it and what you may need to do.
For self-hosted instances, you are responsible for detecting and responding to incidents in your environment. If we learn of a vulnerability in the platform that affects you, we will publish a fix and describe it in the release notes.
Related: Terms of Service · Privacy Policy · Acceptable Use Policy · Data Processing Addendum · Subprocessors · Cookie Notice · Store Terms · Publisher Agreement · Paid Apps Addendum · Security