Data protection

Union.ai protects customer data through a classification framework, residency guarantees, and cloud-native encryption. All customer data is encrypted both at rest and in transit.

Customer data never transits Union.ai’s control plane. Every customer-data request – bulk artifacts (via presigned URLs), structured task inputs and outputs, secret writes, logs, reports, and auxiliary UI traffic – is served directly from the data plane through the Direct-to-Data-Plane tunnel. In the default zero-trust data plane, an Envoy router inside the customer’s cluster authenticates each request. The data plane’s dataproxy service then enforces RBAC, asking the control plane’s authorizer for each decision. That check carries the caller’s identity and the requested action, not customer data, so the control plane is not on the data path.

This section covers:

Data classification and residencyHow each data type is classified, and where that classification requires it to be stored.Secrets managementHow secret values stay in customer infrastructure behind a write-only API that never returns them.Logging and auditWhere task logs, metrics, and the audit trail are collected, and who can read them.