That's a good question for any cloud platform. I can only say, that to make it as trustful as possible:

- we encrypt all your environment variables on-flight before they're inside the isolated KVM

- we do a network isolation of customer runners and pipeline jobs in the local network

- we don't store the stdout of your pipeline jobs

- we use ephemeral filesystem in a runtime to avoid storing any data even accidentally