Runner · In-situ execution · Custodian-controlled
The query travels. The data stays.
Runner is the in-situ execution engine that lives inside the custodian's boundary. It receives signed UQL, executes against the local OMOP, returns aggregate-only results, and logs every step. No patient-level data ever crosses the wall.
DEPLOYMENT TOPOLOGY
UNISON CONTROL PLANE
Dispatcher
· UQL artefact
· signed · versioned
· authored by researcher
→ signed UQL━━━
CUSTODIAN BOUNDARY
RUNNER · IN-SITU
Execution engine
· verify signature
· compile UQL → SQL
· execute locally
· aggregate-only
· small-cell suppress
· sign result
data · OMOP CDM · custodian VPC · never leaves
← aggregates━━━+ signed result
RESEARCHER
Results view
· counts · curves
· distributions
· replayable artefact
Query in, aggregates out. Nothing else crosses the boundary.
01 · What Runner is
A small, hardened service. Runs inside your walls. Answers to you.
WHAT IT IS NOT
- Not a data pipe to a remote cloud.
- Not a copy of your data held by Unison.
- Not an agent with free-form access to your warehouse.
- Not a push-based integration you can't audit.
WHAT IT IS
- A stateless execution service that lives inside your VPC or on-prem.
- Receives signed UQL artefacts. Verifies. Executes. Returns aggregates.
- Inspected, logged and controlled by your team — not ours.
- Pull-based by default: nothing happens without an artefact you accept.
02 · Capabilities
Six things Runner does. That's the whole list.
01 · VERIFY
Signed-artefact verification
Every incoming UQL artefact is signed by the dispatcher and co-signed by the authoring researcher. Runner verifies before a single byte of data is touched.
02 · COMPILE
UQL → local SQL
Compiles UQL against the local OMOP instance and vocabulary version. Deterministic, inspectable. The SQL is logged.
03 · EXECUTE
In-situ query execution
Runs inside the custodian's warehouse — Spark, Postgres, BigQuery, Snowflake. Uses the credentials your team grants, nothing else.
04 · AGGREGATE
Small-cell & privacy layer
Small-cell suppression, k-anonymity thresholds and differential-privacy hooks applied before anything returns. Configurable per policy.
05 · SIGN
Signed aggregate result
Result is co-signed by Runner and the custodian identity. Provenance is tamper-evident from query to answer.
06 · LOG
Full execution audit
Every artefact received, every query run, every result returned — logged to a store you own. Pipe it to your SIEM.
03 · Deployment
However your infra team prefers to run it.
01
Kubernetes
Helm chart, horizontal scaling, pod-level RBAC. Most common choice for hospital networks and research clouds.
02
Docker
Single-container deployment for smaller sites and evaluation pilots. Same binary, smaller footprint.
03
Bare metal
Systemd service for regulated environments that do not run containers. Fully supported.
04
Air-gapped
Offline mode for networks with no outbound internet. Artefacts arrive on approved channels; logs stay local.
QUICK START · KUBERNETES
$ helm repo add unison https://charts.hyperunison.com
$ helm install runner unison/runner \
--set omop.url=postgresql://... \
--set dispatcher.trustAnchor=<your-org> \
--set policy.smallCellThreshold=5
# Runner is now live. Nothing executes until you accept an artefact.
04 · SECURITY POSTURE
Built so the default answer to "can it leak?" is structurally, no.
Runner has no outbound path for patient-level data. Its only egress is the signed aggregate result. Reviewed, penetration-tested, and independently assessable — the whitepaper is available on request.
CONTROLS
Ingresspull-based · signed artefacts only
Egressaggregate results · no row-level data
Identitycustodian-issued service account
Secretsyour vault · your rotation
Auditfull log · streams to your SIEM
Kill-switchrevoke trust anchor · runner goes dark
AssuranceCE+ · pentest report
05 · Observability
Your team sees everything, before anyone else does.
Queue of pending artefacts
A dashboard of every incoming UQL artefact: author, protocol, trust anchor, policy fit. Accept, reject, or hold.
Query inspector
Every compiled SQL is available for pre-execution review. Approve individually, or auto-approve within policy.
Result ledger
Every returned aggregate, signed and searchable. Filter by protocol, date, researcher or sponsor. Export for audit.
Standards & fit:· Cyber Essentials Plus· SOC 2-aligned· CFR 21 Part 11-ready· GxP-deployable· EHDS-aligned· FHIR-aware· OMOP CDM-native
06 · Who runs Runner
The custodian stays the custodian.
HOSPITAL NETWORKS
Inside the clinical-data boundary
Runner deploys to your research environment. Your IT team owns credentials, logs, policy. Nothing changes hands.
BIOBANKS & REGISTRIES
Beside the consented data
Consented-cohort governance stays intact. Queries run against exactly the data participants consented to.
NATIONAL DATA BODIES
Aligned to sovereignty posture
Regional data never leaves the region. Runner is operable under national data-sovereignty regimes.
Runner SDK · deployment guide · security whitepaper