Trust Center
Security teams are among the most demanding buyers there are, and they should be. This page sets out how Unizo handles security and compliance, and what documentation we can share for your vendor assessment.
Compliance and frameworks
| Framework | Scope | What it means |
|---|---|---|
| SOC 2 Type II | Report available, Unizo API Fabric | The exposure management product is in audit, with independent penetration testing as part of that work. |
| ISO 27001 | Practices aligned | Designed and operated in alignment with ISO 27001 practices. |
| GDPR & CCPA | Built to support | Built to support EU and California data protection requirements. |
We state scope plainly. Where a framework is not certified, we say so rather than imply more than we can show.
Deployment
Unizo supports two deployment models, so security teams can choose the one that fits their environment and data-residency requirements:
| Model | Description |
|---|---|
| Self-managed | Runs in your own infrastructure or cloud tenant, under your operational control. Your data and your choice of model stay with you. |
| Unizo-hosted | Dedicated, single-tenant environments on Azure or GCP, managed by Unizo. |
Our security and audit practices apply consistently across both.
Data protection
Data is encrypted in transit using TLS. In Unizo-hosted deployments, data is encrypted at rest with AES-256 using cloud-provider encryption, enabled by default. In self-managed deployments, encryption at rest is governed by your own infrastructure. Access to systems follows least-privilege principles, and sensitive operations are scoped and recorded.
Access control and identity
Role-based access control, two-factor authentication, and single sign-on through standard identity providers are in development. In a self-managed deployment, access to the environment Unizo runs in is governed by your own infrastructure controls.
Audit and accountability
Unizo keeps tamper-evident, append-only audit records of system activity, so teams can trace what happened, when, and who did it. Records include the timestamp, the actor identity, the action taken, and its outcome.
Incident response and breach notification
Unizo maintains a documented incident response plan. In the event of a confirmed personal data breach, we will notify affected customers within 72 hours of confirmed awareness, consistent with GDPR Article 33, with enough detail for customers to meet their own notification obligations. Report a security concern: [email protected].
How Unizo connects to your tools
Unizo connects to your security and infrastructure tools over their APIs, authenticating with credentials that you provide and control. Those credentials are held in a secrets vault, isolated per customer, and never stored in application storage. You can revoke them at any time, which ends Unizo's access to the connected tool.
Where your data lives
Self-managed: Live Security Context stays inside your own environment. Unizo has no access to it.
Unizo-hosted: your data runs in a dedicated, single-tenant environment on Azure or GCP, isolated from every other customer. Regions are available on request.
How Unizo uses AI
Unizo reasons over your environment to investigate exposures and draft remediation Plans. What that means in practice:
- Your data is not used to train models. No customer data enters model training, ours or anyone else's.
- You choose where inference runs. In self-managed deployments, Unizo runs against your own model in your own AI platform, so no environment data leaves your tenant. In Unizo-hosted deployments, limited context is sent to a model provider we disclose on request.
- AI does not change your environment. Plans are drafted for your team to approve, and the accountable owner applies every change.
- Every conclusion is traceable. The evidence behind a conclusion comes from your own tools and is recorded, so decisions can be reviewed rather than trusted.
Documentation for your review
The following are available on request for vendor assessments and security reviews:
- Security overview
- Incident response plan
- Data Processing Agreement
- Sub-processor list
Request the security package by emailing [email protected]. We respond within two business days.
Contact
Security inquiries: [email protected] · Privacy inquiries: [email protected]