How Ruunly keeps your website trustworthy

What we scan when a page is published

Every time a tenant publishes a page on Ruunly, an automatic background scan runs against two independent checks:

• →Text content — the rendered page text is sent to OpenAI's moderation API (omni-moderation-latest) to detect categories such as harassment, sexual content involving minors, hate speech, and content promoting violence.
• →Outbound links — every external URL on the page (up to 50 per scan) is checked against Google Web Risk for known malware, social-engineering (phishing), and unwanted-software threats. Links back to Ruunly itself are excluded.

What happens when something is flagged

If either check trips, three things happen automatically:

• 1.The scan result is persisted to our abuse-reports table with the reason (moderation, link-reputation, or both) and the specific flagged links.
• 2.The tenant account is marked flagged with a timestamp and reason code, which routes the next publish through a stricter manual-review path.
• 3.Our trust & safety team gets a real-time alert with a deep-link to the page and the flag reason, so a human can decide whether to keep the page up, request changes from the tenant, or take it down.

Invisible to honest operators

If you are running a normal service business — listing your services, taking bookings, linking to your social accounts — you will never see any of this. The scan runs in the background after publish, takes seconds, and only surfaces a review queue when something actually trips a check. There is no extra step, no pre-publish form to fill out, no "please wait while we review your website" delay. Your page goes live; the scan happens in parallel.

False positives can happen — a legitimate page that mentions a sensitive topic, or links to a site that was recently flagged elsewhere. When that happens, we review and clear it, usually within a business day.

What we do not do

• →We do not scan customer PII. The content scanner runs against your published marketing pages — the public-facing copy your site visitors see. It does not run against customer records, invoices, or anything inside the operator dashboard or the customer portal.
• →We do not use your content to train AI. OpenAI's API terms specify that data sent through the moderation endpoint is not used for model training. Google Web Risk receives only the raw URL of each external link, not your page content.
• →We do not share scan results with anyone except the affected tenant and our trust & safety team. If law enforcement asks, our standard legal-process policy applies — see the privacy policy for the full process.