Trust, privacy, and compliance

Security, access control, and transparency reporting

Understanding how Unless handles security, access control, and transparency is essential for organizations operating in regulated industries. The platform is built with compliance-by-design, meaning GDPR, EU AI Act, DORA, ISO 42001, and OWASP standards are integrated into the architecture rather than added as afterthoughts. This article explains the operational security measures, how access is managed, and what transparency commitments you can expect.

Operational security measures

Unless follows strict operational procedures for deployment, monitoring, and threat prevention. All deployment procedures are automated after formal code reviews, with human involvement only required for user testing. This reduces the risk of human error during releases.

Continuous monitoring covers performance, availability, and security through automated processes and occasional manual checks. Additional firewalls restrict open ports on internet-facing servers, and an Intrusion Protection System (IPS) acts as a secondary security layer, blocking access upon detecting suspicious login attempts. A threat detection service identifies and prevents unauthorized behavior to avert security breaches.

Patch management is designed to avoid affecting security vulnerabilities. The microservices architecture allows for independent updates of system components, enabling targeted patches and bug fixes without disrupting the entire platform.

Access control and authentication

Access to the Unless platform is tightly controlled. Only engineers who need access to perform their tasks efficiently are granted system access, with varying rights based on their responsibilities. Unique credentials are assigned to each user, SSH Key-Based authentication is used for server access, and security access rights are reviewed monthly.

For customer accounts, Unless offers three user roles:

Admin: all rights within a customer account
User: everything except user management
Team Assistant only: can authenticate the browser extension but cannot see the dashboard

The customer has the sole right of granting access to anyone. Unless employees have no access by default. Passwords are always hashed and salted using bCrypt, and data at rest and in motion is always encrypted using TLS with at least 128-bit AES encryption. Data transport uses TLS with SHA-256 and RSA Encryption.

To add a support agent who only needs the Team Assistant, open Account and billing > Team and roles > Add user and pick the Team Assistant only role. For workspace-wide security, you can enable MFA by opening the security policy and switching on Require MFA. Existing users get prompted on next sign-in. SSO is available on enterprise plans, supporting SAML 2.0 with all major providers.

When a user leaves the company, open the user’s profile and click Remove. They lose access immediately, but their action history stays in the audit log.

Data protection and privacy

Unless implements multiple layers of data protection. The platform is cookieless by default, and advanced tracking can only be used after triggering the consent API. Personal data is kept in protected user-profiles separate from ad-hoc user input, and PII is filtered from user input so personal data never reaches the AI. User profiles are located in heavily secured data storage in the European Union only.

The architecture is heavily fortified with firewalls, encryption, shielded Lambda containers, and extensive DDoS protection. Personal data is filtered at ingestion and at runtime, so identifiers are removed or masked before they enter the model. Where personal context is required, it is tokenized through the Privacy Vault, and the model only sees tokens, not the underlying identifiers.

Continuous data backups are conducted for point-in-time recovery (PITR), with electronic copies maintained for 35 days and encrypted during transit and at rest. A legal retention policy requires the deletion of personal data, including files, databases, and backups, with encryption using 256-bit Advanced Encryption Standard (AES-256).

Transparency and reporting

Unless takes data policies seriously. What data is stored, why, where, and for how long is exposed transparently. The platform maintains complete audit trails for every interaction, and all system updates, configuration changes, and access are logged to provide an audit-trail if unauthorized or accidental changes are made.

Unless will at all times keep you informed about changes to the processes that protect data privacy and security, including practices and policies. In the event that personal information is compromised as a breach of security, Unless will promptly notify customers in compliance with applicable law.

The security and privacy dashboard is accessible at /dashboard/trust/privacy, where you can configure PII filters, review audit trails, and manage compliance controls. The Compliance Center contains the security addendum alongside the DPA and the sub-processor list. Your account manager can also send a signed copy.

Your organization’s responsibilities

While Unless handles platform security, your organization retains responsibility for implementation-specific decisions. You control what information becomes available to the AI, so audit all training sources for accuracy and relevance, remove or redact sensitive internal information, and verify data retention policies meet your requirements.

Configure who in your organization can access and manage the AI. Define user roles and permissions in Unless, document who has access to AI management functions, set up SSO if required by your security policies, and plan for access revocation when team members change. Ensure customers know they are interacting with AI, provide a clear escalation path to human support, and update privacy policies to reflect AI data processing.

Establish ongoing security practices, including quarterly access reviews, regular content audits, incident reviews, compliance updates, and vendor reviews. Security is not a one-time setup but a continuous process.

Conclusion

Unless provides a comprehensive security framework covering infrastructure, access control, data protection, and transparency. The platform handles many security risks at the platform level, but your organization must manage implementation-specific decisions around data import, access permissions, and customer-facing disclosures. By understanding both sides of this shared responsibility model, you can maintain a secure and compliant AI implementation.