Customer data,
what is actually in place.
What we encrypt, how customers are kept apart, which vendors touch your data, and what we don't have yet.
What runs in production today.
Only what is in place now. Where a control is partial, the description says so.
HTTPS for every page and API call, and the database accepts only TLS connections. The database and file storage are encrypted at rest by Azure's built-in storage encryption.
App sign-in goes through Google (OpenID Connect), so we never handle your password. MFA follows your Google account's settings; we don't enforce it separately yet.
Customer data is stored per business, and Postgres row-level security on tenant tables limits a signed-in user to their own business's rows.
Platform API keys are injected as Azure Container Apps secrets at deploy time, never committed to source. Credentials you connect are stored in the application database, encrypted at rest by Azure but not yet encrypted separately by the application.
The database runs on Azure Database for PostgreSQL with automated backups and point-in-time restore. We have not yet run a documented restore drill.
When a platform admin opens a customer account to help, the start and end of that session are written to an append-only audit table: who, which business, when, and why.
The vendor list. Fully public.
The vendors that process customer data for the platform today, taken from the production configuration. Customers are told before a new one is added; the DPA sets the notice period.
Where we stand on the standards.
We hold no security certifications and have had no third-party audit yet. Here is where we stand on each standard.
We don't have a SOC 2 report. We'll list it here when we do.
No ISO certification.
Our DPA is public. There is no GDPR certification, and we don't claim one.
Access, correction, and deletion requests go to privacy@unioneleven.ai.
The platform is not set up for protected health information. Don't send us PHI.
The platform does not collect or process payment card data.
Suspect a vulnerability? Email security@unioneleven.ai.
Stop publishing.
Start compounding.
See the system on your own data. Bring a campaign or a quarter of CRM — we'll show you the brief, the assets, the test plan, and what the loop would ship in week one in 30 minutes.