Security overview
This page summarises the security controls a prospective customer or IT reviewer will ask about. Policies, the SOC 2 report and vendor documentation are on the Unifuse Trust Center.
Identity
Section titled “Identity”- Users sign in only through their institution’s identity provider over OIDC or SAML. Unifuse holds no passwords. See Single sign-on.
- Accounts are provisioned and deactivated by the identity provider through SCIM, and a deactivated account is refused at sign-in even if the identity provider still accepts it.
- Institutions set an idle timeout and a maximum session length, and can end any user’s sessions at once. See Session policy.
Tenant isolation
Section titled “Tenant isolation”Every institution’s data is isolated at the database layer: the database itself enforces that a request scoped to one institution can read or change only that institution’s rows. A request with no institution scope sees nothing. This is not left to application code.
Permissions
Section titled “Permissions”Every screen and every API call is gated by a permission on the user’s role, and the server enforces it on each request. Institutions edit the permission matrix themselves; see Roles.
Encryption
Section titled “Encryption”Data is encrypted in transit and at rest. Credentials for connected systems are stored encrypted and separately from the rest of a source’s configuration, and are never shown back after entry.
Audit log
Section titled “Audit log”Sign-ins, failed sign-ins, session events, administration changes, provisioning, data access, unmasking of personal data, messages to students and every AI tool call are written to an append-only audit log that is never purged. Institutions can read and export it. See Audit log.
Governed AI
Section titled “Governed AI”The assistant answers only from the institution’s own sources and says when it cannot. Any action it proposes runs under a trust tier that decides who must approve it, with the exact parameters shown before anyone says yes. Some actions are never available to it. An administrator can pause every agent with one switch. See Approvals and trust tiers.
Student contact
Section titled “Student contact”Every message to a student passes a contact gate: consent, a per-student message budget, quiet hours, and review where the institution requires it. Opt-outs are honoured on every channel and can never be overridden. See Contact policy.
Hosting
Section titled “Hosting”Unifuse runs on Google Cloud in the United States. Service status and incident history are published on the status page.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Email security@unifuse.ai. The Trust Center lists the current disclosure policy.
Related
Section titled “Related”View this page as Markdown for use with an AI assistant, or read the whole site at /llms.txt.