Trust
Security
Version 1.0 · Last updated 2026-05-27
A customer-facing AI has more attack surface than a normal SaaS tool. Prompt injection, model manipulation, data leaks. Security in Unless covers the LLM-specific risks alongside the standard ones.
Key concepts
Encryption
Data encrypted in transit and at rest. Industry-standard cipher suites. Keys managed through AWS Key Management Service.
Access controls
Role-based permissions with least-privilege defaults. Multi-factor authentication available for all users. SSO via SAML for enterprise plans.
LLM-specific safeguards
Mitigations for the OWASP Top 10 LLM risks. Covers prompt injection, insecure output handling, model denial of service, training data poisoning, and more.
Secure integration design
Integrations validated and sanitized to prevent injection or insecure output. Plugin authentication required. Parameterized inputs.
Network and infrastructure security
AWS hosting in the EU (Ireland) with firewall and intrusion detection. Auxiliary workloads in EU regions of Microsoft Azure and Google Cloud. Code reviews and secure coding practices. Continuous monitoring and anomaly detection.
ISO certification posture
Unless does not hold its own ISO 27001 certificate as a legal entity. Cloud infrastructure is certified through our providers: AWS is ISO/IEC 27001, ISO/IEC 27017, and ISO/IEC 27018 certified. Authentication and supporting services run on providers with the same level of certification. We operate an information security management system modeled after ISO 27001 and 27002:2022. We monitor ISO/IEC TR 24028 on AI trustworthiness and are working toward ISO/IEC 42001 for AI management systems.
Incident response
Documented plan for detecting, managing, and disclosing incidents. Customer notification commitments in the DPA.
What you can do here
- Configure access controls for your team
- Switch on MFA and SSO
- Review the OWASP Top 10 LLM safeguards your account has enabled
- Manage integration credentials and rotate them
- Export the security addendum for your security team
When to use it
- During the initial security review of a pilot
- When a team member’s role changes or they leave
- When rotating API keys for an integration
- When responding to a security questionnaire
How it works
Security sits underneath every other section. Train, Test, Deploy, Analyze, Trust all run inside the same secured platform. You configure access and review controls here. The platform enforces them everywhere else.
Frequently asked questions
How do I enable MFA for the whole workspace?
Open "Trust > Security > Access controls". Switch on the "Require MFA" policy. Existing users are prompted to set it up on their next sign-in.
How do I rotate an integration API key?
Open the integration and click "Rotate key". The new key is issued immediately. The old key keeps working for 24 hours to allow updates.
How do I report a suspected security issue?
Email security@unless.com. The team triages within one business day. Critical issues escalate immediately.
Where is the security addendum?
In the Compliance Center alongside the DPA and the sub-processor list. Your account manager can also send a signed copy.
How are LLM-specific risks mitigated?
The platform applies the OWASP Top 10 LLM mitigations: input validation, output sanitization, rate limits, supply chain validation, sensitive information protection. The full list is in Accountability.
Is Unless ISO 27001 certified?
Unless does not hold its own ISO 27001 certificate. Cloud infrastructure is certified through our providers (AWS, Azure, Google Cloud). Our ISMS is modeled after ISO 27001 and 27002:2022, and we are working toward ISO 42001 for AI management systems.
Has Unless had any data breaches or government access requests?
No significant personal data breach in the last three years. No data access requests from non-EU government authorities. If a lawful request ever arrives, our policy is to limit disclosure to what is strictly required and to notify the affected customer where the law allows.
Does Unless support SSO?
Yes, on enterprise plans. SAML 2.0 with all major providers. Setup happens in Team and roles.
