Trust Center

1. Security Overview

Unify implements comprehensive security measures to protect customer data throughout its lifecycle. Our security approach is built on industry best practices and zero-trust principles.

Key Security Principles

• End-to-end data protection with encryption at rest and in transit
• Zero-trust architecture requiring verification for every access request
• Role-based access controls (RBAC) ensuring users only access necessary resources
• Multi-factor authentication (MFA) for enhanced account security
• Data segregation and multi-tenant isolation to prevent cross-tenant access
• Threat modeling and secure software development lifecycle (SDLC) practices
• Comprehensive vendor risk management program
• Regular penetration testing and security assessments

[Additional content about security architecture, security team, and ongoing security initiatives should be added here.]

2. Compliance & Certifications

Unify maintains compliance with industry standards and regulations relevant to our services. Below is our current compliance status and roadmap.

Compliance Roadmap

3. Data Protection & Privacy

Unify is committed to protecting your data and respecting your privacy rights. This section outlines our data handling practices. For more detailed information, please see our Privacy Policy.

Data Processing Policy

• GDPR-compliant data handling procedures
• Data minimization principles - we only collect necessary data
• Purpose limitation - data used only for stated purposes
• Data retention policies aligned with legal requirements

Data Storage Locations

Unify stores customer data in the following regions:

• Primary Cloud Region: U.S East, Virginia
• Backup/DR Region: US West, Oregon
• Cloud Provider: Amazon Web Services

Data Retention & Deletion

Customer data is retained according to our data retention policy. Upon request, we will delete customer data in accordance with applicable laws and our contractual obligations.

To request data deletion or submit other security, trust, and data-related requests, please use the form below.

Note: Submissions can be made for security reviews, trust information requests, data deletion requests, and other related inquiries in the Request Trust Information section.

Subprocessors

We maintain a current list of subprocessors that handle customer data. See the Subprocessors section for details.

Logs & Monitoring

Unify maintains comprehensive logging and monitoring systems to detect and respond to security events. Logs are retained according to our retention policy and are used solely for security and operational purposes.

4. Infrastructure & Architecture

Unify's infrastructure is designed for security, reliability, and scalability. This section provides an overview of our technical architecture.

Cloud Infrastructure

• Cloud Provider: Amazon Web Services
• Primary Regions: US East, Virginia
• High Availability: Multi-region deployment with automatic failover
• Redundancy: N+1 redundancy for critical systems

Recovery Objectives

• RTO (Recovery Time Objective): 4 hours
• RPO (Recovery Point Objective): 1 hour

Backup Strategy

• Automated daily backups with point-in-time recovery
• Backups stored in geographically separate regions
• Regular backup restoration testing
• Encrypted backup storage

Encryption

• Encryption in Transit: TLS 1.2+ for all data transmission
• Encryption at Rest: AES-256 encryption for stored data
• Key Management: AWS KMS

Authentication & Access

• Password Hashing: Bcrypt
• API Authentication: OAuth 2.0, JWT tokens
• Tenancy Model: Multi-tenant with logical data separation

5. Product Security Controls

Unify platforms include comprehensive security controls to protect your data and ensure secure operations.

6. AI Safety, Transparency & Governance

Unify.AI is built with security, transparency, and responsible AI practices at its core. This section outlines how we protect customer data in AI-powered features.

Data Protection in AI Features

• No Training on Customer Data: Customer data is never used to train public AI models
• Model Isolation: Each tenant's data is processed in isolated environments
• Data Minimization: Only necessary data is sent to AI models for processing
• Audit Logs: All AI agent actions are logged for security and compliance

MCP (Model Context Protocol) Security

Unify.AI uses the Model Context Protocol (MCP) to securely manage AI model interactions:

• Secure context management and isolation
• Controlled access to customer data
• Audit trails for all MCP operations

Tool-Calling Sandbox Environments

AI agents operate within sandboxed environments to prevent unauthorized access:

• Isolated execution environments for AI tool calls
• Resource limits and access controls
• Monitoring and alerting for suspicious activities

Security Protections

• Prompt Injection Protections: Input validation and sanitization to prevent prompt injection attacks
• Guardrails & Policy Enforcement: Automated policy checks to ensure AI outputs meet security and compliance requirements
• Hallucination Mitigation: Techniques to reduce AI hallucinations and improve output accuracy

Model Transparency

Unify.AI uses the following model families (subject to change based on customer needs and availability):

• OpenAPI, ChatGPT, Claude, and USI Internal LLM - Orion
• Model selection is configurable per tenant
• Customers can view which models are used for their data processing

7. Incident Response

Unify maintains a comprehensive incident response program to quickly detect, respond to, and recover from security incidents.

24/7 Monitoring

Our security operations center (SOC) provides continuous monitoring of our systems and infrastructure to detect potential security threats.

Incident Response Process

1. Detection: Automated monitoring and alerting systems detect potential incidents
2. Assessment: Security team assesses the severity and impact of the incident
3. Containment: Immediate steps taken to contain and prevent further impact
4. Investigation: Detailed investigation to understand root cause and scope
5. Remediation: Steps taken to resolve the incident and prevent recurrence
6. Communication: Affected customers notified according to our notification timeline
7. Post-Incident Review: Lessons learned and process improvements

Severity Classifications

8. Penetration Testing

Unify conducts regular penetration testing to identify and remediate security vulnerabilities before they can be exploited.

Testing Frequency

• External Penetration Testing: Annual assessments by third-party security firms
• Internal Security Testing: Quarterly internal security assessments
• Continuous Vulnerability Scanning: Automated scanning on a regular basis

Testing Partners

Unify engages with reputable third-party security firms for independent penetration testing. Testing partners include:

• Accunetix

Testing Methodology

Our penetration testing follows industry-standard methodologies including:

• OWASP Top 10 testing
• Network infrastructure testing
• Application security testing
• Social engineering assessments (where applicable)

9. Reliability & Uptime

Unify is committed to providing reliable, high-availability services. Monitor our system status and uptime metrics in real-time.

Uptime Commitments

Unify maintains the following uptime commitments (varies by service tier):

• Enterprise Tier: 99.9% uptime SLA
• Standard Tier: 99.5% uptime SLA

Maintenance Windows

Planned maintenance is scheduled during low-traffic periods and communicated in advance. Maintenance windows are typically:

• Scheduled during off-peak hours
• Announced at least 48 hours in advance
• Minimized to reduce service impact

Status Notifications

Subscribe to receive automated alerts about system status, incidents, and maintenance:

• Email notifications
• Webhook integration for automated monitoring
• RSS feed for status updates

10. Legal Center

Access all legal documents, policies, and agreements in one place.

11. Subprocessors

Unify uses third-party subprocessors to provide our services. This list is updated regularly and customers are notified of material changes.

12. Vulnerability Disclosure Program

Unify values the security research community and encourages responsible disclosure of security vulnerabilities.

Responsible Disclosure Policy

We ask security researchers to follow responsible disclosure practices:

• Report vulnerabilities promptly after discovery
• Provide detailed information about the vulnerability
• Allow reasonable time for remediation before public disclosure
• Do not access or modify data without authorization
• Do not perform denial of service attacks

Safe Harbor

Unify will not pursue legal action against security researchers who:

• Act in good faith and follow responsible disclosure practices
• Do not access data beyond what is necessary to demonstrate the vulnerability
• Do not violate any laws or breach any agreements

Scope

How to Report

Please report vulnerabilities to: support@myunifyai.com

Include the following information in your report:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested remediation (if any)

Response Timeline

• Initial Response: Within 48 hours
• Triage: Within 5 business days
• Status Updates: Regular updates throughout remediation process

13. Request Trust Information

Enterprise customers and prospects can request security documentation and complete vendor security questionnaires.

14. Dedicated Contact Channels

Use the appropriate contact channel for your specific needs. Our team is ready to assist with security, privacy, and trust-related inquiries.