Roles
You are the controller of personal data uploaded into AstraRunner. AstraGenie acts as processor and processes data only on your documented instructions.
Security
TLS in transit, AES-256 at rest, tenant-scoped row-level isolation, managed identity for all internal service-to-service auth.
Sub-processors
Current sub-processors are listed at /legal/subprocessors. We notify you 30 days before adding a new sub-processor.
International transfers
EU/UK personal data stays in EU regions by default. Standard Contractual Clauses are signed where transfers occur.
Audits
You may request our SOC 2 Type II report annually. Email security@astrarunner.com.