Security
IT leaders, risk officers, and chiefs need straight answers—not invented certifications. RunReady is an AWS-hosted cloud platform with encryption in transit, granular roles, and organization policies you control. We partner with agencies on security questionnaires and compliance conversations where EMS patient documentation applies.
Strong sign-in options for members in the field, at dispatch, and in the station—without forcing a single vendor lock-in.
Support for WebAuthn passkeys—including YubiKey and other FIDO2 security keys—plus device biometrics (Face ID, Touch ID, Windows Hello). Passkeys are phishing-resistant and optional alongside Google, Apple, and email one-time codes.
Modern authentication that works for chiefs, dispatchers, and field crews.
Organizations can require members to confirm their account email after passkey authentication. Failed attempts are limited per session; repeated failures trigger account lockout with administrator notification.
Extra verification layer when your policy demands it.
Automatic lockout after repeated failed passkey email challenges. Account administrators receive notification and can unlock users from personnel management—restoring access only through defined admin action.
Brute-force resistance with a clear recovery path for legitimate users.
Each department sets membership and watch rules that match how it actually operates—open volunteer recruitment or locked-down county dispatch.
Require a valid invite link or QR code to join the roster. Recommended for multi-org accounts, healthcare-adjacent EMS, and any agency that needs controlled membership growth.
No surprise users on your organization roster.
For invite-only organizations, control which non-member account users can add your org as a watch-only FYI source—open to all account users or restricted to selected organizations (e.g., county dispatch desk).
Situational awareness without opening membership to everyone.
Members can be limited to notifications for specific apparatus or units. Watch-only modes respect organization watch policy and cannot be set as default responding identity.
Least-privilege alerting at the unit level.
RunReady separates account-wide security levels from org rank leadership—so permissions map to how public-safety agencies are actually structured.
Security role changes require the user to sign in again. Account administrators—not individual members—control who holds elevated access. This operational model supports audit conversations about who can administer personnel, change security settings, and access dispatch tools.
RunReady runs on Amazon Web Services (AWS)—the same class of cloud infrastructure used by enterprises worldwide.
Application services, APIs, and data stores run in AWS. No on-premises server maintenance for your IT team—availability and backups are handled as part of the cloud architecture.
Enterprise-grade hosting without department-owned data centers.
Data transmitted between RunReady clients (mobile, web) and our APIs uses industry-standard TLS encryption. Credentials and session tokens are protected in transit.
Protected communication from the apparatus cab to the cloud.
Every API request is authorized against the authenticated user's account security level, org membership, and rank. Data is scoped to organizations the user belongs to or is authorized to watch.
Members see only what their role permits—not the entire account.
RunReady respects member privacy and complies with applicable regulations.
We are honest about what RunReady is—and what we have not certified.
Where EMS agencies use RunReady for patient care documentation, we are willing to support Business Associate Agreements (BAAs) as appropriate to your use case. Contact us to discuss your documentation workflow and contractual requirements.
A path forward for agencies with healthcare documentation obligations.
RunReady is not SOC 2 certified, FedRAMP authorized, CJIS certified, ISO 27001 certified, or "HIPAA certified." We do not invent compliance badges. We will walk through our actual controls and architecture with your team.
Straight answers for procurement and risk review.
Municipal, county, and hospital-adjacent agencies often require vendor security questionnaires before procurement. We respond to structured reviews and can schedule technical conversations with your IT and compliance stakeholders.
Support your due-diligence process—not dodge it.
Request a demo, submit your security questionnaire, or schedule a call with our team. We will answer questions about access control, cloud architecture, and compliance partnership directly.