Security & Compliance
where trust is the product
Unblu offers secure, certified cloud infrastructure fully designed, managed, and operated by Unblu - across three deployment environments built for the demands of regulated financial services.
Three certified deployment environments
Choose the infrastructure that fits your sovereignty requirements, regulatory environment, and operational model. All three options are covered by Unblu's own certifications and 24/7 operations.
Unblu Financial Cloud on GCP
Multi-region deployment. Clients select their failover region to meet geofencing requirements. Covered by Unblu's ISO 27001 and SOC 2 Type 2 certifications.
Unblu Swiss Sovereign Cloud
Hosted by T-Systems Schweiz AG in two Swiss data centres - Zollikofen and Bern. Designed for institutions requiring full Swiss data sovereignty. Also covered under ISO 27001 and SOC 2 Type 2.
IBM FS Cloud Validated
Purpose-built for regulated financial workloads. Unblu has passed IBM's rigorous security review, with the highest levels of encryption, preventive and compensatory controls, and proactive automated security measures.
Designed for uninterrupted operations
99.75% committed SLA
The Unblu Financial Cloud offers a 99.75% uptime SLA for production environments. This is a legally binding commitment that gives you contractual assurance of reliability. Internally, we operate to a higher 99.95% uptime objective.
In-region RPO and RTO
Within a region, Unblu Financial Cloud on GCP offers an RPO of 0 (no data loss) and an RTO of 2 minutes, so an incident within the region causes no data loss and minimal disruption.
Failover region
For GCP deployments, in the event of a full regional failure (all three data centres), the Unblu application can be restored in an alternate region within 3 days, with an RPO of 24 hours. Clients select their backup region to comply with geofencing requirements. For OTC, failover operates between the two Swiss data centre locations in Zollikofen and Bern.
Multi-region availability
Unblu Financial Cloud is available in data centres across Europe, North America, and APAC, with 24/7 operational support from Unblu's cloud operations team.
Independently audited and verified
Unblu holds certifications across the most widely recognised information security and cloud compliance frameworks in financial services.
ISO 27001:2022
Unblu is ISO 27001 certified for the operation and provisioning of cloud-based software services - the international standard for information security management, requiring systematic identification, assessment, and treatment of information security risks.
SOC 2 Type 2
Our SOC 2 Type 2 report provides independently audited evidence of the controls we apply to protect client data and maintain operational transparency. Covers our GCP and OTC deployments, based on 2017 AICPA Trust Services Criteria.
IBM FS Cloud Validated
Unblu has passed IBM's rigorous security and compliance review for financial services workloads - validating adherence to the industry's most stringent standards, including the highest encryption levels and controls designed for regulated environments.
IRQAO Registered
Unblu's ISO 27001 certification is registered with IRQAO and available for independent verification, providing clients with a transparent, externally accessible record of our certification status.
GCP Platform Certifications
GCP-based deployments benefit from Google Cloud's extensive portfolio of infrastructure-level compliance certifications. Unblu also has a Financial Services Addendum with Google Cloud, which supports regulated customers and their supervisors in auditing the underlying infrastructure.
GDPR Compliant
Unblu and its affiliates are committed to compliance with Swiss and EU data protection regulations, as well as applicable requirements in other jurisdictions where Unblu operates, including the US and Canada.
Infrastructure & cloud security
Data encrypted at rest with AES-256
Encryption keys managed with automated rotation
No Unblu-owned data centres - certified hyperscale providers only
Traffic between the user's browser and the platform encrypted with TLS 1.2 or higher
Swiss sovereign cloud deployment available
Web application firewall with DDoS protection
Tenant isolation enforced by network policy and namespace segregation
Production separated from development and test environments
All infrastructure configuration held as version-controlled code
Container platform hardened and continuously scanned
Nightly encrypted backups, replicable to an independent provider
Platform availability monitored continuously, with automated alerting to the on-call engineer
Cloud backup restores tested at least quarterly
Customer file uploads scanned for malware
Organizational security
Background screening for all employees, and for contractors with privileged access
Enhanced screening for staff with access to customer data
Security awareness training throughout the year
Confidentiality obligations survive termination
Criminal record checks at medium and high risk tiers, with sanctions screening where legally permitted
Staff with access to customer-identifying data must be direct Unblu employees
Cloud operations staff re-screened annually
Privileged remote access permitted only from Switzerland and the EEA
Additional security onboarding for cloud operations staff
NDA and Code of Conduct acknowledged by every employee
Joiner-mover-leaver provisioning automated from the HR system
Documented disciplinary process for policy breaches
Named executive accountability for information security
Full-disk encryption mandatory on every business device
Clear desk and clear screen policy
Physical data-centre security provided by certified hosting partners
Product security
Independent penetration testing every year
Vulnerability remediation service levels defined
Automated vulnerability scanning in the build pipeline
Executive penetration test summary available on request
Secure development lifecycle (SDLC) followed
CVE monitoring with a 24-hour triage target
Every production change peer-reviewed and approval-gated
Deployment to production fully automated, with rollback
Source code access restricted and change-controlled
Security requirements defined at specification stage
Customer production data never used for testing
Deep audit log of all configuration changes
Responsible disclosure channel: security@unblu.com
Single sign-on via OpenID Connect and JWT, with TOTP two-factor
Login rate limiting and enforced session timeouts
Internal security procedures
Production access restricted to hardened, centrally managed devices with two-factor authentication
Access to customer data is temporary and approval-gated
No standing write access to production systems
Production access rights reviewed quarterly
Zero-trust architecture restricting access to production resources
Removable media disabled on production access devices
Secrets held in a managed vault, never in code or configuration
Disabling or reducing security logging requires management approval
Documented incident management process, with root cause analysis for major incidents
Major cloud incidents notified to affected customers within 8 hours of Unblu becoming aware
Major-incident thresholds defined in advance
Every security policy reviewed at least annually
Legal authority data requests handled as security incidents
Business continuity plans with per-scenario disaster recovery runbooks
Business continuity and disaster recovery tested at least annually
Forensic readiness with pre-approved external advisors
Internal ISMS audit at planned intervals, with annual management review
Suppliers with access to customer data expected, as a baseline, to hold ISO 27001 certification and/or a SOC 2 report
Right-to-audit clauses included in supplier agreements as standard
Cloud data-processing suppliers reassessed annually
Incident and vulnerability management procedures aligned with DORA, supporting EU customers’ operational resilience obligations
Data & privacy
Unblu acts strictly as data processor
GDPR and Swiss nFADP aligned
Data Protection Officer appointed
Configurable data retention policies
Conversation data retained for one year by default, or as agreed in your DPA
Customer data deleted after the agreement ends, as defined in your DPA
Secure deletion, including cryptographic erasure where required
No cross-border transfers without your instruction
Every sub-processor operates under a data processing agreement
Information classification and handling policy in force
ISO 27018 controls for personal data in public clouds implemented
Unblu staff must not export customer data
Unblu staff must not view customer data without your request
Audit log records source IP, actor and before/after state
Audit log entries retained for 365 days by default
AI governance
AI Governance and Transparency Policy published
Named executive accountability for AI
Unblu does not use customer data to train AI models
Human oversight designed into AI-supported decisions
AI-generated content can be labelled in the user interface
AI components follow the same secure development lifecycle as the rest of the platform
Unblu Spark is not designed or intended for high-risk AI use under the EU AI Act
AI is not intended to automate significant decisions without human review
Model access governed by API isolation and logging
No exposure of model weights or training data
Internal AI use policy governs staff use of AI tools
Documentation on demand
Easy access to the certificates, policies, and audit reports your organisation needs to meet its compliance obligations.
CSR Policy
Unblu's approach to corporate social responsibility, based on ISO 26000:2010. Covers our commitments to people, environment, and the communities we operate in.
Whistleblowing Policy
Ensures all Unblu employees can raise concerns about wrongdoing or malpractice without fear of retaliation, discrimination, or dismissal.
Code of Conduct
Unblu's Business Code of Conduct and Ethics, setting out the standards of behaviour expected across the organisation.
ISMS Information Security Manual
Documents Unblu's Information Security Management System, enabling systematic assessment and treatment of information security risks in line with global best practices.
ISO 27001 Certificate
Our current ISO 27001:2022 certificate, available for direct download.
SOC 2 Type 2 Report
Externally audited report covering Unblu's Conversation Platform Services infrastructure, based on 2017 AICPA Trust Services Criteria.
ISMS Statement of Applicability
The SoA linking risk assessment to risk treatment across Unblu's ISMS implementation — a core requirement for ISO 27001 compliance.
Cloud Privacy Notification
Covers Unblu's compliance with Swiss and EU data protection laws, and applicable requirements in other jurisdictions including the US and Canada.
Cloud Cookie Policy
Details on the essential, technically necessary cookies used by Unblu products.
Whitepaper
Unblu Financial Cloud
Request the latest version of our cloud whitepaper - covering deployment options, security architecture, certifications, and operational capabilities in full detail.
