Implement · Runware
Can you run it?
Ownership levelPartialnone·limited·partial·substantial·fullAnalytical input D ยท 50.4/100
This page is a projection of the one entry record, the Reliability and Data control factors that Implement covers. The full verdict is set by all four factors together, floor-weighted so the weakest caps the whole.
Which domain expands which factor
- AssessUse & modify + Transparency
- ImplementData control + Reliability
- UseReliability
- SupportTransparency
API integration
Runware exposes one unified API that addresses its full open-model catalogue behind a single
schema, with the Sonic Inference Engine as the orchestration layer. OpenAI compatibility is not
confirmed, so integrate against Runware's own API shape and take endpoint and SDK
specifics from the developer docs.
Region & residency configuration
Inference pods exist in the US and central Europe, and the Trust page advertises "EU & US"
residency. Whether an EU-only region can be pinned contractually, and how, was not found in the
read documents, and the binding entity is Runware Ltd (UK) under UK law. Confirm any
region-pinning guarantee directly before relying on EU residency.
Portability & exit
The catalogue is open-weight Hugging Face models, so the same checkpoints run on other providers
or self-hosted and the models are fully portable. The API, however, is a proprietary unified
schema, so client code is written to Runware's shape and must be rewritten to move. The switching
cost is in the API surface, not the model.
How this scores
The ownership factors this domain covers, drawn from the one entry record.
3
ReliabilityDoes it stay up and stay secure?
ModerateA USD 50M Series A and advertised enterprise custom SLAs indicate scale, but there is no public uptime SLA, status page or independent attestation, so reliability is asserted, not observable.
How this scores (AOI sub-dimensions)
Reliability2/5whether it stays up, with an SLA and status historyA USD 50M Series A (December 2025) and advertised enterprise custom SLAs indicate production scale, but no public uptime SLA or status page was found, so availability is asserted rather than independently observable.
Security3/5the controls protecting your traffic and dataThe Trust page carries SOC 2 / ISO 27001 badges and a vulnerability-disclosure channel, and models run on Runware-operated hardware.
Compliance1/5which independent certifications and attestations it holdsSOC 2 and ISO 27001 appear as badges only, with no readable report, and no public DPA was located (both URLs 404).
4
Doesn't extract your dataDo the binding terms keep your data and IP yours?
ModerateCORRECTED 2026-09-21: the prior worldwide, perpetual, transferable licence over inputs/outputs and non-confidentiality declaration is no longer supported by the current Terms - the customer now owns Outputs outright with no broad licence granted to Runware, and Sec 3 confirms no training on Training Data/Trained Models. Held at moderate, not strong: retention remains generic with no auto-purge (Privacy Policy Sec 6, unchanged), inference sub-processors beyond Stripe/Google Analytics are undisclosed, and the confidentiality-removal finding is inferred rather than verbatim-diffed against the prior snapshot.
How this scores (AOI sub-dimensions)
Data governance3/5retention, training-on-inputs and data ownershipCORRECTED 2026-09-21: the prior finding of a worldwide, perpetual, transferable licence over inputs/outputs and a non-confidentiality declaration is no longer supported by the current Terms of Service (independently browser-read, two fetches, targeted negative search confirming the old clauses' absence) - the current text instead has the customer own Outputs outright, grants Runware no broad licence, and now-verbatim Sec 3 confirms no training on Training Data/Trained Models, with nothing in the current text permitting training on ordinary inputs either.
Residency2/5where your data is processed and storedThe Trust page advertises "EU & US" residency, but no contractual region-pinning document was found, the binding entity is Runware Ltd (UK) under UK law, and US CLOUD Act is not addressed.
What this means for adoptionYou partly own workloads here, but this picture improved materially on independent re-verification (2026-09-21). The models are open weights, so use, modification and exit stay fully in your hands, and self-hosting the same checkpoints avoids the hosted data terms entirely. On a hosted basis, the current binding Terms no longer grant Runware a broad licence over your inputs and outputs or deem them non-confidential - a 2026-08-06 pass found exactly that, but the current text (independently re-read) shows the customer owns Outputs outright and Runware commits not to train on your data. Load-bearing caveat: this correction is inferred from the current text's absence of the old clauses, not a verbatim old-vs-new diff (web archives were proxy-blocked). What has not improved: retention is still generic with no auto-purge or numeric window, and SOC 2/ISO 27001 remain self-asserted badges with no readable report. Use Runware with more confidence than before for ordinary workloads, but still confirm retention terms directly and request the underlying compliance reports before regulated use.
Sources
The same evidence records as the entry sheet. Read means the text was verified; unverified means it is known to exist but not yet read.
Terms of serviceread2026-07-26
Runware Terms of Service (Runware Ltd, UK; read 2026-07-26): the customer owns the Generations (outputs) but grants Runware a worldwide, perpetual, transferable licence over inputs and outputs; the Terms reference "storing training data and models per our pricing schedule"; UK governing law and London arbitration; termination at Runware's sole discretion; data deleted on request.
Privacy Policyread2026-07-26
Runware Privacy Policy (Runware Ltd, UK; read 2026-07-26): generic retention ("as long as necessary" / account life) with no auto-purge or opt-in-storage clause; training use not addressed; sub-processors named are only Stripe and Google Analytics; GDPR/UK GDPR referenced without naming SCCs or the EU-US Data Privacy Framework.
Securityunverified2026-07-26
Runware Trust page (read 2026-07-26, partial): "Data residency EU & US" badge with no contractual region-pinning document located; SOC 2 and ISO 27001 shown as badges only with no readable certificate or report; a separate security-disclosure page for vulnerability reporting.
Vendor announcementread2026-07-26
Runware pricing page (read 2026-07-26): pay-as-you-go usage-based pricing with representative rates; enterprise plans add dedicated capacity and custom terms.
Vendor announcementunverified2026-07-26
Runware website ("One API for all AI"): a unified API over a large catalogue of open-weight Hugging Face models run on Runware's own Sonic Inference Engine; low usage-based pricing; markets a US HQ and states data belongs to the customer (marketing framing not supported by the binding Terms/Privacy read this session).
Third-party analysisread2026-07-26
Independent press (SiliconANGLE and others, Dec 2025): Runware raised a USD 50M Series A (Speedinvest and others) to build "one API for all AI"; markets a San Francisco HQ with operations in London and 10+ countries (the binding legal entity is Runware Ltd, UK); inference pods in the US and central Europe; aims to make the broad Hugging Face open-model catalogue addressable behind one schema.
Terms of serviceread2026-09-21
Runware Terms of Service, current version (independently browser-read 2026-09-21, two fetches including a targeted negative search for the prior adverse clauses).