Trust

Security

Version 1.0 · Last updated 2026-06-25

Platform-level controls protecting your data, your integrations, and the agent itself against attacks and accidental misuse.

A customer-facing AI has more attack surface than a normal SaaS tool. Prompt injection, model manipulation, data leaks. Security in Unless covers the LLM-specific risks alongside the standard ones.

Key concepts

Encryption

Data encrypted in transit and at rest. Industry-standard cipher suites. Keys managed through AWS Key Management Service.

Access controls

Role-based permissions with least-privilege defaults. Multi-factor authentication available for all users. SSO via SAML for enterprise plans.

LLM-specific safeguards

Mitigations for the OWASP Top 10 LLM risks. Covers prompt injection, insecure output handling, model denial of service, training data poisoning, and more.

Secure integration design

Integrations validated and sanitized to prevent injection or insecure output. Plugin authentication required. Parameterized inputs.

Network and infrastructure security

AWS hosting in the EU (Ireland) with firewall and intrusion detection. Auxiliary workloads in EU regions of Microsoft Azure and Google Cloud. Code reviews and secure coding practices. Continuous monitoring and anomaly detection.

ISO certification posture

Unless does not hold its own ISO 27001 certificate as a legal entity. Cloud infrastructure is certified through our providers: AWS is ISO/IEC 27001, ISO/IEC 27017, and ISO/IEC 27018 certified. Authentication and supporting services run on providers with the same level of certification. We operate an information security management system modeled after ISO 27001 and 27002:2022. We monitor ISO/IEC TR 24028 on AI trustworthiness and are working toward ISO/IEC 42001 for AI management systems.

Incident response

Documented plan for detecting, managing, and disclosing incidents. Customer notification commitments in the DPA.

What you can do here

Configure access controls for your team
Switch on MFA and SSO
Review the OWASP Top 10 LLM safeguards your account has enabled
Manage integration credentials and rotate them
Export the security addendum for your security team

When to use it

During the initial security review of a pilot
When a team member’s role changes or they leave
When rotating API keys for an integration
When responding to a security questionnaire

How it works

Security sits underneath every other section. Train, Test, Deploy, Analyze, Trust all run inside the same secured platform. You configure access and review controls here. The platform enforces them everywhere else.

Common questions

How do I enable MFA for the whole workspace?

Open "Trust > Security > Access controls". Switch on the "Require MFA" policy. Existing users are prompted to set it up on their next sign-in.

How do I rotate an integration API key?

Open the integration and click "Rotate key". The new key is issued immediately. The old key keeps working for 24 hours to allow updates.

How do I report a suspected security issue?

Email security@unless.com. The team triages within one business day. Critical issues escalate immediately.

Where is the security addendum?

In the Compliance Center alongside the DPA and the sub-processor list. Your account manager can also send a signed copy.

How are LLM-specific risks mitigated?

The platform applies the OWASP Top 10 LLM mitigations: input validation, output sanitization, rate limits, supply chain validation, sensitive information protection. The full list is in Accountability.

Is Unless ISO 27001 certified?

Unless does not hold its own ISO 27001 certificate. Cloud infrastructure is certified through our providers (AWS, Azure, Google Cloud). Our ISMS is modeled after ISO 27001 and 27002:2022, and we are working toward ISO 42001 for AI management systems.

Has Unless had any data breaches or government access requests?

No significant personal data breach in the last three years. No data access requests from non-EU government authorities. If a lawful request ever arrives, our policy is to limit disclosure to what is strictly required and to notify the affected customer where the law allows.

Does Unless support SSO?

Yes, on enterprise plans. SAML 2.0 with all major providers. Setup happens in Team and roles.