RightNow procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ For EU users: By using our services, you consent to this transfer. You have rights under GDPR including the right to lodge complaints with your local data protection authority.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We implement industry-standard security controls: TLS 1.2+ in transit, AES-256 at rest, role-based access control with hardware-key 2FA for production access, row-level security for tenant isolation, continuous logging and monitoring, dependency and secret scanning on every CI build, and annual third-party penetration testing. The full controls program is documented on the Security page . Independent attestation. RunInfra is SOC 2 Type II attested. The audit report is available to current customers and qualified prospects under NDA at trust.rightnowai.co or by request to jaber@runinfra.ai . Breach notification. In the event of a personal data breach affecting your Personal Information, we will notify you without undue delay, and in any case within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures we are taking to contain and remediate. This commitment applies regardless of where you reside and matches the GDPR Article 33 standard. Use a strong, unique password or sign in with Google or GitHub, and keep your API keys secret. We urge you to keep your credentials safe and to log out after each session on shared devices. No method of transmission over the Internet or method of electronic storage is 100% secure, and the controls above mitigate but do not eliminate risk.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ RunInfra is SOC 2 Type II attested. The controls governing the handling, retention and deletion of the data described in this section are covered by that audit, which evaluates operating effectiveness over a defined window rather than at a single point in time. The most recent report, the auditor's identification and the period covered are available to current customers and to qualified prospects under NDA at trust.rightnowai.co . The routing subprocessor listed above applies to the separate unified provider-routing endpoint, not to these hosted Model APIs. Where the two differ, this section governs the hosted Model APIs.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ To exercise these rights, email osama@rightnowai.co . We will respond within 30 days.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Our services are primarily operated from the United States. The primary database, web tier, and engine API are hosted in US regions. Inference compute provided through RunPod can be region-selected, including EU regions, when the Customer configures a deployed endpoint in those regions; in that case the inference inputs and outputs routed to that endpoint are processed in the selected region while account data, telemetry, and billing remain in the US. If you access our services from outside the United States, your data will be transferred to and processed in the US. We implement appropriate safeguards including:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ When you sign an enterprise license, we retain a signature record containing the company legal name, signer full name, signer email, typed signature string, IP address, user agent, and signature timestamp. The record also identifies the package and license version and stores the SHA-256 hash of the exact license text accepted. We use this record for performance of the enterprise license contract and for our legitimate interest in enforcing the enterprise license terms. We retain the full record as contract evidence for the life of the license plus any applicable limitation period.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Permanently delete your account, pipeline configurations, benchmark data, and personal information that we are not required or permitted to retain within 30 days” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Prompt content is not persisted. It is held in memory only for as long as it takes to serve the request, and is discarded when the response completes. One narrow exception exists for completions, by design: when you send an Idempotency-Key header with a non-streaming request, the response body is held in a replay cache for up to 24 hours, used only to return the same answer to a retry carrying that key, then it expires. Streaming responses are never stored. Requests without an Idempotency-Key leave no stored prompt or completion text. What we record per request is metering metadata: the model identifier, input and output token counts, latency, HTTP status, the billed amount and the price basis applied. This is what a usage record and an invoice are built from. Outside the 24-hour replay window, we cannot retrieve, replay or export the text of a past request, including on your own request.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Account data and pipeline configs not covered by a stated exception: Permanently deleted within 30 days Enterprise license signature records: Retained as contract evidence for the life of the license plus any applicable limitation period” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Exceptions: Billing records are retained for 7 years for tax compliance. Enterprise license signature records are retained as contract evidence for the life of the license plus any applicable limitation period. Anonymized usage data may be retained for analytics.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ To delete your account and all associated data, email osama@rightnowai.co with subject line “Account Deletion Request”. We will:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Enterprise license signature records: Retained as contract evidence for the life of the license plus any applicable limitation period” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Modal GPU compute for model profiling and serving Model identifiers, inference inputs and outputs during benchmarking US RunPod Managed GPU inference endpoints for deployed pipelines Inference inputs and outputs routed to your deployed model US / EU (region-selectable) OpenRouter Unified LLM provider routing for the inference proxy Prompts and completions routed when you use the unified API endpoint US ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Non-Personal Information: We use Non-Personal Information to improve the Service and customize the user experience. We aggregate Non-Personal Information to track trends and analyze usage patterns. We reserve the right to use and disclose such information to partners and third parties at our discretion.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Hosted Model APIs inference is served from GPU hardware located in the United States. Model weights run on hardware we operate directly. Your prompts are not forwarded to a third-party model provider to be served.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Resend Outbound transactional email delivery Email addresses, transactional content US Google Workspace Inbound email handling and internal collaboration Inbound emails sent to jaber@runinfra.ai and osama@rightnowai.co US / EU (Google global) Hugging Face Model registry Model selection, download requests US / EU PostHog Product analytics Page views, feature usage, anonymized session data (all form inputs masked) US / EU Upstash Rate limiting Request counts per user (no content data) US ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ These providers access your data only to perform services on our behalf and are contractually obligated to protect your data. For questions about our subprocessors, contact osama@rightnowai.co .” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ The following terms apply only to coding plans and take precedence over conflicting general terms. A coding plan that never starts serving is refunded in full. Credit purchases, packages and legacy subscriptions remain subject to the general non-refund clause above. Your coding plan automatically renews each month until canceled. Your payment method is charged at the start of each billing period. Cancel anytime in Billing, in any plan state. Cancellation takes effect at the end of the current billing period, or immediately while a payment dispute is open. Upgrades take effect now with a prorated charge. New limits apply immediately, and usage already counted carries over. Downgrades take effect at the end of the current billing period. Account deletion ends the plan at once, with no refund of the current month. Credits survive cancellation and keep their existing expiry dates. Standby is best effort and can be paused or reduced at any time. Standby is paused while a plan payment is outstanding or processing, and while credits are owed. The meter is versioned. We give you written notice before changing how usage is metered. A disputed plan payment pauses the plan and ends it at the period end.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ We may offer a free trial for a limited period. If you do not cancel before the end of the free trial, your payment method will be charged for the subscription.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Some catalog packages require a separate signed Enterprise Package License before purchase. That license governs your use of the restricted package and is in addition to these Legal Terms rather than replacing them.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Your subscription will continue and automatically renew unless canceled. Your payment method will be charged at the start of each billing period. You may cancel at any time via your account settings or by contacting us.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.