Security

Security you can verify.

Umi is in early access. Planned controls are not represented as live until they are implemented and verified.

Security at a glance

Encryption standards are being specified and will be verified before customer data is processed
Role-based access controls are planned
Audit logging is planned
AI data-use terms are being finalized with model providers
Cloud, VPC, on-premise and air-gapped options are under evaluation
SOC 2 and ISO 27001 readiness has not been achieved

Hosting and infrastructure

Hosting and deployment models are being evaluated. Availability, hosting providers and supported environments will be confirmed before customer data is processed.

Cloud region selection is under evaluation
Dedicated VPC deployments are under evaluation
On-premise and air-gapped deployments are under evaluation

Encryption

Encryption standards are planned and will be documented after implementation and verification.

Target baseline: TLS 1.2+ for traffic
Target baseline: AES-256 at rest
Customer-managed keys are under evaluation

Access control

Access-control features are planned; supported controls will be documented after implementation.

Role-based access control is planned
SSO/SAML and SCIM are under evaluation
Per-agent permissions and approval gates are planned

Audit and monitoring

Audit and monitoring capabilities are planned and will be documented when available.

Audit trail is planned
SIEM export is under evaluation
Anomaly detection is under evaluation

Incident response

An incident response process is being documented before customer services launch.

Incident response procedures are being prepared
Customer notification procedures will be published before paid services launch
Post-incident reporting terms are not yet published

Data and AI

The AI data-use policy is being finalized with model providers. No customer product data is currently processed.

Model-provider data-use terms are being reviewed
Product data deletion procedures are being designed
The complete production subprocessor list is not yet finalized

Compliance roadmap

We publish what is in place and what is in progress, and update this page as things change.

SOC 2 Type I

In progress

Audit preparation underway.

ISO 27001

In progress

Gap assessment in progress.

GDPR

In progress

Privacy documentation and operating procedures are being reviewed.

Responsible disclosure

Found a vulnerability? Report it to our security team with enough detail to reproduce. We acknowledge within 3 business days and keep you informed as we fix it.

Report a vulnerability

Security contact

Write to our security team for vulnerability reports, security questionnaires or audit requests.

security@umitech.io · Subprocessors