1. Scope of this overview
1.1This overview explains the allocation of security responsibilities for Uniforce and how to obtain service-specific assurance information. It summarizes, but does not replace or expand, the security commitments in the Agreement, DPA and applicable service schedule. Available features depend on the contracted service and configuration. A certification, independent audit or recovery commitment applies only where expressly identified for the relevant service; a supplier’s assurance report does not certify Uniforce’s application.
2. Company responsibilities
2.1For the contracted Services, Company must maintain the safeguards required by applicable law and the agreed DPA, restrict personnel access, protect confidential information, handle incidents within its responsibility and govern Company subprocessors. Outsourcing infrastructure or model processing does not by itself eliminate these obligations.
2.2Before live processing, the security schedule must be supported by evidence of the applicable access, authentication, tenant isolation, encryption, logging, backup, recovery and vulnerability-management arrangements. This review release does not assert SOC 2 or ISO certification, a hosting region, an uptime percentage or a tested recovery target.
3. Customer responsibilities
3.1Customer must nominate administrators, limit tool and data access, protect credentials, review permission changes, select approval rules, monitor available records and disable inappropriate workflows. Customer must verify which controls are available in its selected plan and connected services and avoid use cases requiring unsupported safeguards.
3.2Customer remains responsible for its business continuity arrangements and copies of critical records, without relieving Company of agreed backup or data-return obligations. Security controls reduce risk; they do not guarantee correct business judgment by an Agent.
4. Reporting and assessment
4.1Report suspected security incidents to security@uniforce.work and urgent operational problems through the agreed support channel. Do not send passwords or unnecessary personal information. This mailbox is not a representation of 24-hour response coverage.
4.2Security assessment material should be requested through your account contact and provided subject to reasonable confidentiality. Testing the live service requires prior written authorization. Personal-data incident notification and audit rights are governed by the DPA.
5. Identity, access and privileged operations
5.1Access must be appropriate to the person’s role and the task being performed. The DPA and service-specific security schedule govern Company personnel access, confidentiality and access removal. Customer administers its own users and connected credentials and must promptly remove access that is no longer required.
5.2An administrator’s ability to change Agent permissions can be consequential. Customer should separate routine use from sensitive administration, require approvals where available and review changes to tools and credentials. A role label alone does not establish which permissions are enforced; the purchased configuration and documentation define those capabilities.
6. Agent and integration security
6.1An Agent’s natural-language instructions and its technical permissions serve different purposes. Instructions describe a task; enforced access controls constrain what systems and data it can reach. Customer should grant the smallest available scope appropriate to its task and avoid using a broadly privileged personal account where a restricted service account is available.
6.2Retrieved content, tool responses and external webpages can contain malicious instructions. Review requirements and permission restrictions should reflect the consequence of an action, especially external communication, deletion, payment and account administration. Security controls do not certify the factual or professional quality of a model response.
6.3Remote servers, browser sessions and Customer-provided extensions introduce their own trust boundaries. Customer must assess the operator and transmitted data before connecting them. Company-procured integrations remain subject to applicable Company obligations; a module label does not shift those duties to software.
7. Data protection, isolation and transport
7.1The agreed security schedule records protections for data in transit and at rest, tenant isolation and privileged access for the relevant service. Contractual safeguards apply to the processing scope described in the DPA. A storage region does not by itself exclude remote access from another country; both must be assessed.
7.2Customers must avoid uploading secrets into free-text prompts or unnecessarily including sensitive information in support reports. Use the designated secure connection mechanism where provided. Encryption and isolation protect against particular risks; they do not authorize processing for an otherwise prohibited purpose.
7.3Protection applies throughout the processing lifecycle, including authorized support, export, return and deletion. The DPA and agreed retention schedule distinguish active information, operational records and backup copies. Expiration of workspace access does not necessarily mean every permitted backup has already expired, and continued retention does not authorize ordinary reuse. Any restored copy remains subject to applicable deletion instructions and retention limits.
7.4The baseline security measures use AWS hosting in Ireland, TLS 1.2 or later for transmission, AES-256 or comparable encryption at rest and AWS KMS for key management. Automatic encrypted backups and periodic restoration tests support the documented recovery plan. The DPA specifies the three-month active-data and nine-month backup deletion ceilings after termination; valid earlier deletion instructions and legal retention exceptions remain applicable.
8. Logging and review
8.1Activity records can support operational supervision, investigation and reconciliation. Available fields, retention and export rights depend on the contracted service. Customer should confirm that the records available are adequate for its regulatory and business requirements before using a consequential workflow.
8.2A complete record of every event at an independent provider, every browser-side action or a model’s internal reasoning is not promised. Missing external records do not conclusively prove that no action occurred. Customer must reconcile important transactions with the destination system and retain evidence it needs within the applicable retention period.
8.3Customer-visible activity history and Company security records serve different purposes. Limits on the history available in the workspace do not remove Company’s duties to maintain security evidence under the DPA. Access to internal records may be restricted to protect security, personal information and other customers, subject to applicable audit, incident-cooperation and legal disclosure obligations. Neither category of record is a guaranteed transcript of every external action.
8.4Security monitoring uses AWS CloudWatch, Cloudflare, GitLab and internal logs. Restricted security logs are retained for at least 24 months under the security policy and reviewed for continued necessity thereafter. Workspace action records and model reasoning are distinct from internal security evidence.
9. Incident response and recovery
9.1Report suspected compromise promptly, with affected account or execution identifiers, approximate times, impact and a safe contact route. Pause harmful workflows and revoke compromised credentials where appropriate. Preserve relevant evidence without continuing exploitation or collecting other customers’ information.
9.2Company’s personal-data incident notice and cooperation duties are set out in the DPA. Initial facts may be incomplete and supplemented as the investigation progresses. A security report is separate from a support availability claim, and receipt of a report is not a promise of a particular resolution time.
9.3Recovery depends on the nature of the incident and the agreed backup and recovery scope. A restored platform does not undo a message delivered, a payment processed or data deleted in an independent system. Customer must maintain continuity procedures for its own business and assess whether external actions require separate correction.
9.4A vulnerability report, an interruption of service, an incorrect Agent action and a personal data breach are different events, although one event may fall into more than one category. Personal-data notification duties follow the DPA and applicable law; availability remedies follow the applicable SLA. Whether an event originated in Customer configuration or an external service does not by itself remove Company’s duties for data it processes. Allocation of liability is determined separately under the Agreement and applicable law.
10. Assurance, testing and vulnerability disclosure
10.1Request service-specific security material through security@uniforce.work or your account contact. Relevant evidence may be supplied subject to confidentiality and protection of other customers. This overview does not claim that Uniforce holds ISO 27001, SOC 2 or another certification, or that a provider’s certificate covers our application.
10.2Live security testing requires written authorization describing the environment, dates, methods and limits. If you discover a vulnerability unintentionally, stop at the minimum evidence needed to report it; do not extract unrelated data, disrupt availability or publish personal information. Reporting does not grant permission for further exploitation or promise a bounty.
10.3Assessments and contractual audit rights are governed by the DPA. A marketing overview cannot reduce those rights or override a binding security schedule. We will update material service descriptions when the relevant verified practices change.
11. Security governance and service changes
11.1Company’s security obligations cover the systems, personnel and authorized subprocessors used to deliver the contracted Services. The applicable DPA and security schedule govern responsibility for access management, personnel confidentiality and instruction, security risk assessment, vulnerability handling and changes affecting Customer Personal Data. Customer administration of a workspace does not transfer responsibility for Company-controlled infrastructure or application safeguards to Customer.
11.2Changes to the contracted security measures are governed by the DPA. Updating a security description does not itself amend an agreed obligation or reduce the agreed level of protection. Security improvements, vulnerability remediation and changes to an Agent’s behavior are distinct: a security review is not an assurance that an automated business action is correct.
11.3The Company uses a documented development and change-management process with GitLab CI/CD security checks, separated production, staging and development environments, pre-release review and testing, and post-release monitoring. Privileged access requires MFA, least-privilege permissions, at-least-quarterly access reviews and revocation when no longer needed. Staff and authorized contractors receive confidentiality obligations and security training. Independent penetration testing is performed at least every two years; remediation is prioritized by risk.