{
  "title": "Runtrace Data Inventory",
  "summary": "Runtrace collects developer security metadata needed to prioritize vulnerable tools, risky dependency state, sensitive asset presence, scan workflow, and billing state. It does not collect secret values, source contents, shell history, or document contents.",
  "uploaded": [
    {
      "name": "Device and organization metadata",
      "purpose": "Identify the enrolled developer device and keep tenant-scoped fleet state current.",
      "fields": [
        "Organization slug, device ID, device name, agent version, and check-in/upload timestamps.",
        "Admin-maintained owner, team, and business criticality labels.",
        "Enrollment token usage metadata, device bearer-token authentication state, and last-seen timestamps.",
        "Agent update attempt stage, source and target versions, package SHA-256, bounded failure code, and stage timestamps."
      ]
    },
    {
      "name": "Developer inventory metadata",
      "purpose": "Identify installed developer software so the hosted service can check exact package versions and return device results.",
      "fields": [
        "Package, tool, or binary name, version, ecosystem/kind, source path or filename, and last-observed timestamp.",
        "Per-item identity method and confidence, install scope, package-manager origin, parent package, executable path, file SHA-256, and signing identifiers where available.",
        "Per-item central vulnerability coverage status, checked source/time, package identity, advisory count, and bounded explanation.",
        "Dependency metadata parsed from lockfiles, including dependency names and versions."
      ]
    },
    {
      "name": "Findings and vulnerability metadata",
      "purpose": "Prioritize remediation by vulnerability, affected package, affected devices, and fix availability.",
      "fields": [
        "Finding category, title, severity, confidence, affected path or package, evidence summaries, and remediation text.",
        "Advisory identifiers, aliases, CVSS score/vector, installed version, fixed version, CISA KEV status, FIRST EPSS score/percentile, and authoritative malicious-package evidence when available.",
        "Workflow status, admin notes, actor, and timestamps for fixed, accepted-risk, and false-positive decisions."
      ]
    },
    {
      "name": "Remote scan, remediation, and report metadata",
      "purpose": "Audit remote scans and allowlisted package updates, then produce weekly security reports without arbitrary remote execution.",
      "fields": [
        "Remote scan profile, selected custom roots, configured scan caps, reason, requester, status, timestamps, result, and error summary.",
        "Structured remediation action type, package and target version, affected device and vulnerability, approval reason, lifecycle timestamps, exit status, verification result, and bounded error summary.",
        "Active scanner policy pack ID/name, scheduled home-relative workspace roots, upload-path preference, EndpointSecurity flag, and sensitive path rule patterns.",
        "Support case subject, description, requester email, owner, category, severity, status, response/resolution targets, and operator notes.",
        "Weekly report metrics including new/fixed findings, top vulnerability groups, affected device counts, and high/critical trends.",
        "Clean-Mac pilot acceptance metadata including package checksum/version, device ID, macOS version, aggregate coverage counts, check verdicts, recorder, and audit event ID.",
        "macOS lifecycle acceptance metadata including previous/current package versions and checksums, phase receipt hashes and timestamps, Developer ID team identifier, uninstall/offboarding verdicts, recorder, and audit event ID.",
        "Audit events for billing changes, policy pack changes, remote scan queueing, report generation, enrollment token changes, and allowlist changes."
      ]
    },
    {
      "name": "Billing and session metadata",
      "purpose": "Gate Business and Enterprise features and keep the account auditable.",
      "fields": [
        "Plan, billing status, seat limit, active device count, current period, Revolut customer/subscription identifiers, and webhook event IDs.",
        "Business workspace request contact metadata: company name, requester name, work email, seat estimate, notes, status, and admin follow-up note.",
        "OIDC subject, email, roles, allowed organization claims, session expiry, and CSRF-protected admin form metadata."
      ]
    }
  ],
  "notUploaded": [
    "Secret values, API tokens, private key contents, certificate contents, or .env values.",
    "Source file contents, document contents, screenshots, clipboard contents, shell history, or terminal output.",
    "Full package-lock.json, lockfile, manifest, or script body contents; Runtrace stores dependency metadata and install-script keys only.",
    "Arbitrary command output. Remote scans are structured scan-profile requests, and remediation jobs use fixed package-manager argument arrays instead of shell commands.",
    "Raw enrollment tokens after creation. Stored enrollment tokens are hashed; the raw token is shown once.",
    "Lifecycle phase receipt bodies, enrollment tokens, Keychain values, or local evidence directories. Runtrace retains only the bounded final receipt and phase SHA-256 values."
  ],
  "controls": [
    "Hosted enrollment requires organization-scoped enrollment tokens, and telemetry uploads require device bearer-token authentication.",
    "The hosted service performs OSV, CISA KEV, and FIRST EPSS lookups from exact package metadata, caches results across devices, and does not send tenant or device identifiers to those providers.",
    "Telemetry ingestion rejects obvious raw private-key and API-token values in summaries or metadata before storing snapshots.",
    "Admin access uses server-side sessions, httpOnly cookies, Keycloak/OIDC roles from JWKS-verified ID tokens, tenant organization claims, and CSRF tokens on forms.",
    "Remote scan profiles are capped, audited, limited to one active scan per device, expire after 24 hours, and reject scanner-excluded private/system/temp/device paths for custom roots.",
    "Remediation jobs are admin-approved, audited, limited to one active job per device, expire after 24 hours, reject unrecognized package identities, and require preflight plus post-update verification scans.",
    "Individual accounts receive the standard scanner policy. Custom policy packs, scheduled roots, and organization allowlists require an active Business or Enterprise entitlement.",
    "Business billing gates block paid operations when checkout is pending, past due, canceled, or missing checkout/customer-handoff evidence; Enterprise activation is manual and auditable.",
    "Allowlist rules require organization scope, reason, creator, and optional expiration so noisy findings do not hide globally by accident.",
    "Organization export at /organizations/{slug}/export gives authorized admins a tenant-scoped JSON package for support, review, or data portability.",
    "Clean-Mac pilot receipts are accepted only when they match the current signed package, active device, recent telemetry, complete OSV and workspace coverage, and Full Disk Access.",
    "Lifecycle receipts are accepted only when they match the current package SHA-256, prove the fixed upgrade/rollback/reinstall/retirement/uninstall sequence, retain recent central-analysis telemetry, and reference a retired dedicated test device."
  ],
  "_links": {
    "admin": {
      "href": "/admin",
      "method": "GET"
    },
    "backup_restore": {
      "href": "/backup-restore",
      "method": "GET"
    },
    "backup_restore_json": {
      "href": "/backup-restore.json",
      "method": "GET"
    },
    "buyer_pack": {
      "href": "/buyer-pack",
      "method": "GET"
    },
    "buyer_pack_json": {
      "href": "/buyer-pack.json",
      "method": "GET"
    },
    "detections": {
      "href": "/detection-catalog",
      "method": "GET"
    },
    "dpa": {
      "href": "/dpa",
      "method": "GET"
    },
    "lifecycle_acceptances": {
      "href": "/agent-package-lifecycle-acceptances",
      "method": "GET"
    },
    "pilot_acceptances": {
      "href": "/agent-package-pilot-acceptances",
      "method": "GET"
    },
    "policy_packs": {
      "href": "/policy-packs",
      "method": "GET"
    },
    "pricing": {
      "href": "/pricing",
      "method": "GET"
    },
    "privacy": {
      "href": "/privacy",
      "method": "GET"
    },
    "retention_policy": {
      "href": "/retention-policy",
      "method": "GET"
    },
    "retention_policy_json": {
      "href": "/retention-policy.json",
      "method": "GET"
    },
    "review": {
      "href": "/security-review",
      "method": "GET"
    },
    "security": {
      "href": "/security",
      "method": "GET"
    },
    "self": {
      "href": "/data-inventory",
      "method": "GET"
    },
    "severity": {
      "href": "/severity-model",
      "method": "GET"
    },
    "status": {
      "href": "/status",
      "method": "GET"
    },
    "status_json": {
      "href": "/status.json",
      "method": "GET"
    },
    "subprocessors": {
      "href": "/subprocessors",
      "method": "GET"
    },
    "support_policy": {
      "href": "/support-policy",
      "method": "GET"
    },
    "terms": {
      "href": "/terms",
      "method": "GET"
    },
    "trust_center": {
      "href": "/trust-center",
      "method": "GET"
    }
  }
}