Current protections
ReqRun is designed to handle common failure and abuse scenarios such as API key misuse, repeated retries, and malformed request inputs.
Security basics
- API keys are stored securely and not logged.
- Requests are validated and rate-limited.
- Access is scoped per project.
Key management
- API keys are hashed before storage and full keys are shown only once.
- Project OpenAI keys are stored encrypted and displayed only as a safe hint after save.
- Key prefixes are used for lookup and safe display.
- Revoked keys are immediately rejected.
Request handling
- Strict request validation and payload size limits are enforced.
- Request payloads are stored only where required to process queued work.
- ReqRun is not a data storage system. Request payloads are handled only for execution and are not used for training, analytics, or secondary processing.
Logging and visibility
- ReqRun avoids logging raw request payloads in standard application logs.
- Operational metadata such as status, attempts, and errors is recorded instead.
Rate and usage control
- Rate limiting is enforced per API key.
- Monthly request limits are tracked per project for hosted plans.
Infrastructure overview
ReqRun runs as a minimal service composed of an API process, worker process, dashboard, reverse proxy, and database. This separation limits blast radius and keeps execution isolated.
ReqRun hosted deployments include managed HTTPS, request validation, rate limiting, and controlled execution environments.
For self-managed environments, production setups should include HTTPS, firewall rules, secret management, log rotation, database backups, and restricted filesystem access to environment secrets and database files.
Compliance status
ReqRun is operated by Digiproduct OÜ, an EU-based company.
We follow GDPR principles for handling personal data. API keys and request data are treated as sensitive and are not exposed in logs or dashboards beyond what is required for execution.
ReqRun does not claim SOC 2, ISO 27001, HIPAA, or other formal certifications at launch. Certifications will only be claimed when independently verified.
For security questions or responsible disclosure, contact: [email protected]
© 2026 Digiproduct OÜ. All rights reserved.