Security and data protection
Customer projects are confidential. This is how we protect them.
DraftThis page describes what is built today and is under legal review.
Below is what UnaPlant does, what it does not do yet, and who processes your data. If your company uses a security questionnaire, send it to us before the first call:info@unaplant.com.
Measures
What is in place
- Hosted in the EU
- Application, database and files run on Google Cloud in the Netherlands (europe-west4), and an organisation policy limits resources to EU locations. Google LLC is the US parent of the provider; transfers rest on the EU–US Data Privacy Framework with standard contractual clauses as fallback.
- Separated by design
- Each company is its own tenant, and each customer's projects sit in their own data space. Row-level security is forced on every tenant and space table, and the application's database role cannot bypass it. Platform operators cannot read tenant data.
- Your own sign-in
- Sign-in through your company's identity provider (single sign-on), with multi-factor authentication enforced. Roles are set per tenant, space and project.
- Four eyes, in the database
- Whoever raised a change request can't approve it. The rule is enforced in the database, not only in the interface.
- A complete audit trail
- Security-relevant events and every change to released data are recorded append-only, with who, when and why.
- Encryption
- HTTPS only, with TLS to the database and signed links for files. Data is encrypted at rest with the provider's managed keys. Customer-managed keys are not offered yet.
- Logs without content
- Logs carry IDs, not names, file names, request bodies or AI prompts. They are kept for 30 days.
- Backups and recovery
- Daily backups with point-in-time recovery for 7 days, kept in the EU, and restore drills every quarter.
- Your data, on request
- A tenant can be exported in full and deleted on request, with retention periods set by contract and legal minimums.
AI
AI under control
AI does tedious work as proposals. People decide.
- Off until you switch it on
- AI is off for every tenant by default. A tenant administrator decides whether to use it.
- Proposed, never released
- AI proposes tags, mappings and ratings, each with its source. Nothing reaches released data without a person's approval.
- One gateway, every call logged
- All AI calls go through one gateway to an approved provider. The call log records use case, size, cost and outcome, not the content.
- Processed in the US
- Today the AI provider is Anthropic (Claude API), which processes data in the United States. That is the one exception to EU processing, and we list it as a sub-processor. An EU route is planned for tenants that require it.
Sub-processors
Who processes your data
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google Cloud | Hosting: application, database, files, logs | All customer content, encrypted at rest | Netherlands (europe-west4) |
| ZITADEL | Sign-in, multi-factor authentication, invitations | Name, e-mail, credentials | EU data location |
| Scaleway | Sends sign-in and invitation e-mails | Recipient address and message text | France |
| Anthropic | AI features, only if the tenant switches them on | Content of the AI call: drawing text and images, document excerpts, item data | United States |
| Better Stack | Uptime checks | No customer content; public URL and response codes | EU or US, to be confirmed |
A change to this list is announced to tenants as the contract provides.
Limits
What is not in place yet
We would rather tell you now than have you find out in a questionnaire.
- No certification yet (ISO 27001, SOC 2). The measures above are described, not audited.
- An independent penetration test is planned before the first customer data goes live.
- No backup copy outside the Google Cloud account yet.
- No regional high availability for the database yet.
- No customer-managed encryption keys yet.
- Data processing agreements with the sub-processors are signed before production data is stored.