Protect data.
Understand the work.
UNOY combines permissions, documented processes and agreed approvals. We clarify data processing, responsibilities and available security evidence for your use case.
For organisations that want to get work done with clear roles and traceable steps.
Audit Trail · Matter #4821
Live§ 02 · Trust Center
Control for your workspace.
Access, permitted actions and required approvals are defined for your use case. Documentation supports your review and ongoing oversight.
Continuous Monitoring
Monitored on an ongoing basis.
Security controls are monitored on an ongoing basis. Scope and reports follow the relevant documents.
Data Residency
Data centres in the EU.
Encryption at rest and in transit. Data flows and service providers are described for your use case in the relevant documents.
Certifications
ISO 27001 · SOC 2 Type II · ISO/IEC 42001.
These certifications relate to the data centres used and their operators. Scope and evidence are available on request.
Accountability
Responsibilities matched to the offer.
With Self and CoBuild, your organisation runs ongoing work. With Service, UNOY handles the agreed processing. Required legal services are separately provided by Skribe Rechtsanwälte.
Data Security
What is agreed for your use case.
Data use, storage locations, service providers and access rights are described in the relevant documents. The configuration and agreed services determine the scope.
Model training
Whether and how inputs and outputs are used by the model services involved is clarified and documented for your use case.
Separation of customer data
Your data is not intended for other customers; access follows the agreed permissions.
Storage locations
Storage locations and any access from outside the EU/EEA are described for your use case based on the service providers involved.
Purpose limitation
Your data is processed for the agreed tasks. Other purposes are not pursued without agreement.
Status Quo
What missing governance really costs.
Most organizations structure their work without control over it. The risk: fines, audit findings, and reputational damage.
20 Mio. €
GDPR Maximum Fine
Or 4 % of annual revenue, for violations of the General Data Protection Regulation. Automated processes without an audit trail increase the risk.
Audit
Audit remediation
External auditors, expert opinions and corrective measures cause additional effort for every compliance finding.
AI
Use without rules
If generative AI is used without a governance framework, evidence is missing at the next audit.
For Your Role
Governance solves different problems.
CISO / IT-Security
Understand access and infrastructure
- checkData centre operator certificates (ISO 27001 · SOC 2 Type II · ISO/IEC 42001)
- checkEU data centres, service providers documented
- checkEncryption at rest + in transit
- checkSecurity checklist available for download
Data Protection Officer
Data protection documents for your review
- checkData Processing Agreement (DPA) ready
- checkTOMs documented + auditable
- checkSub-processors documented
- checkAudit trail for matters
Legal / Compliance
Trace and take responsibility for results
- checkRule-based + AI = traceable
- checkApproval workflows per matter
- checkVersioned knowledge base (Skills)
- checkService with agreed legal services
Data Center & Standards
Understand the scope of security evidence.
Check which company, service and scope each document covers. An infrastructure provider’s certifications must be distinguished from UNOY’s own certifications.
EU Data Protection
Data protection
Data minimisation, purpose limitation and access rights are described in the data protection documents for your use case.
Information Security · Data Centers
ISO 27001
The EU data centers where UNOY runs are ISO 27001 certified, the international standard for information security management systems.
Service Organization Controls · Data Centers
SOC 2 Type II
Audit report of the data centre operator by independent auditors; scope on request.
AI Management · Data Centers
ISO/IEC 42001
The data center providers are ISO/IEC 42001 (AI Management) certified, the standard for governance, risk management, and accountability in AI use within infrastructure operations.
Frankfurt · Vienna
EU Sovereignty
Two data centres in Frankfurt and Vienna. Service providers and data flows are documented for your use case.
Security in Daily Operations
How security works in everyday operations
Operational security controls, continuously reviewed, documented, and auditable.
Infrastructure Security
System performance is continuously monitored
Resource monitoring, adapted to current and projected requirements.
Access clearly governed and secured
All system components configured in accordance with company policy.
Organizational Security
Business Continuity & Disaster Recovery
Documented plans, annually tested, communication strategies for key-person failure.
ICT-Readiness
Planned, implemented, and tested based on business continuity objectives.
Data Backup
Backup policy, regular restoration tests.
Product Security
Incident Response
Documented procedures for handling security incidents.
Supplier Contracts
Information security requirements agreed per supplier.
Incident Planning
Processes, roles, and responsibilities defined and communicated.
Data & Privacy
Encrypted Data Transmission
Secure protocols over public networks.
Encrypted Remote Access
Authorized personnel only, encrypted connections only.
Encryption at Rest
Sensitive client data protected at rest.
Internal Security Procedures
Information Security in Project Management
Integrated into every project.
Data Protection Impact Assessment
Conducted for high-risk processing activities in accordance with legal requirements.
Governance
Understand the relevant foundations.
Authorised people see the sources, processing steps and approvals available to their role. Protected skills, code and internal execution logic are not disclosed to everyone.
3×
more measurable value from GenAI
Organisations with structured AI governance achieve three times more measurable business value from GenAI than those without a governance framework, according to Gartner. UNOY supports this framework with roles, approvals and documented steps.
Source: Gartner, “AI Governance Framework”, 2024
Traceability
What does the AI do, what does the rule set do?
Work steps in UNOY are labelled: what the AI contributed, what was executed rule-based in workflows and what a human approved.
From the first input to the result: steps with timestamp, actor and decision, exportable for your review.
Audit Log · Case #7823
Time
Actor
Action
Status
Routine
auto-approvedStandard rule set · example
Wichtig
Review requiredDeviation detected · example
Kritisch
Signature requiredLiability · Precedent · example
Approvals
You decide where it matters.
Approval levels are defined for your use case: routine work can follow approved rules, important matters are reviewed and critical ones require your signature.
Versioned Skills
Knowledge is documented, not merely applied.
Skills, the building blocks of your workflows, are versionable and storable. Each version documents which rules, standards, and decision logic applied at a given point in time. When a standard changes, the previous version is preserved. This allows you to trace at any time on what basis a result was produced.
Skill: GDPR Access Request Check
3 VersionsActive
EU AI Act Integration · Art. 52 transparency obligation added
Archived
Amendment Art. 17 GDPR · deletion periods updated
Archived
Initial version · GDPR as of 01/2025
Know Why · Passenger Rights Check
menu_bookLegal Basis
VO (EG) Nr. 261/2004, Fluggastrechte-Verordnung
Valid since
17.02.2005 · Last review: 01.03.2026
Decision Logic
Art. 7 para. 1 lit. c, distance >3,500 km → €600 compensation. Exception: extraordinary circumstances per Art. 5 para. 3.
Responsible
Dr. Müller · Documented on 12.01.2026
Know Why
The relevant knowledge is part of the workflow.
In the Know Why section of every workflow, the underlying expert knowledge is documented: which standard applies, which interpretation was chosen, why exactly this decision logic. Not added after the fact, but integrated from the start. This ensures that not only the result, but also the rationale is traceable.
Documentation
Documents for your review.
Request the information relevant to your use case on processing, service providers, technical measures and contractual responsibilities.
Terms of Use
Select your country to view the applicable terms of use, including confidentiality provisions and data processing agreement.
Security & Governance Package
All relevant documents for your review, bundled in one package. Request it directly.
- check_circle Data Processing Agreement
- check_circle NDA
- check_circle TOMS
- check_circle Contract Terms
- check_circle SecurityChecklist
Frequently Asked Questions
What you should know
Is my data used to train AI models? add
Whether and how inputs and outputs are used by the model services involved is clarified for your use case and documented.
Where is my data stored? add
In data centres in the EU (Frankfurt and Vienna). Service providers and data flows are described in the documents for your use case.
Can I export the audit trail? add
Yes. Audit trails can be exported as CSV, JSON or PDF.
Who has access to my data? add
Access follows the agreed roles and permissions. Access by UNOY staff is limited to the agreed extent and logged.
What happens in the event of a data breach? add
We follow a defined incident response plan. Notification, containment and documentation follow the agreed timelines and procedures.
Can I involve external auditors? add
Yes. You can grant audit accounts, give auditors access to trails, and generate audit reports directly from UNOY.
How often are penetration tests conducted? add
Frequency and scope of penetration tests and the provision of reports are described in the security documents.
Can I define my own governance rules? add
Yes. You can configure approval requirements, data access policies, and workflow authorizations according to your guidelines.
Who needs governance
Governance is not just an IT topic.
Four perspectives, four use cases, one platform.
P2 · Legal
Governance for Legal Workflows
Playbooks, four-eyes principle, audit trail, versioning per workflow.
P3 · Chamber
Governance for Member Services
WKIS-SSO, audience targeting, versioning of advisory content.
P4 · Claims
Governance for High-volume Matters
SLA, Status-Reporting, Eskalation, KPI logs across pipeline runs.
Service
Governance for Service
Legal services, approvals, audit trail per matter.
P5 · IT / Governance
Review the UNOY architecture against your requirements.
Find your starting point.
Together we clarify which starting point fits your task.