What does a security review need from Unloq?
The short answer
Unloq is Cyber Essentials Plus certified and working towards ISO 27001, with SOC 2 and ISO 42001 on the roadmap. Beyond certification, a reviewer running an AI vendor security review needs to know how Unloq connects, where data sits, how answers are evidenced and how definitions hold, and each has its own page to forward. One finance leader told us in August that the security review, and granting access to their finance system, would be what slowed the start.
Which certifications does Unloq hold?
Unloq holds Cyber Essentials Plus. Cyber Essentials is the UK government scheme run by the National Cyber Security Centre, and Plus is the level that adds more rigorous, independent technical testing to the basic certification.
We are working towards ISO 27001. SOC 2 and ISO 42001 are on the roadmap. If your process requires a SOC 2 report, raise it on the first call, and we will walk your security team through our controls in detail.
What can you send our reviewer?
This table maps common checklist lines to our answers, ready to copy into a reviewer’s own sheet. Each row links to the page that explains it.
Checklist line | Our answer | Where |
|---|---|---|
How does the vendor access our data? | Read-only in both options: Unloq reads the data you approve and does not change or delete it. Your team grants Unloq’s access, and Unloq can reach only what you have enabled | |
Is the vendor tied to one AI model? | No. Unloq is model-agnostic and sends each task to a model that fits it | |
Where is our data stored? | Your data stays where you choose: in your own cloud, or hosted securely in ours. Unloq can run inside your own cloud on AWS or Microsoft Azure | |
Can our data be stored in our region? | In your cloud, yes: your data is stored in the region you require, for example the UK or the EU | |
How is data encrypted? | Data is encrypted in transit and at rest. In your cloud, it can be protected with encryption keys you own and control | |
How do people sign in? | Single sign-on through your existing identity provider (SSO / OIDC) | |
Is access checked by role on every query? | Yes. Role-based access is checked on every query, so a person sees only what their role allows | |
How is personal data handled? | We take in only what a workflow needs, and reference rather than copy wherever we can | |
Is our data moved out to train models? | In your cloud, your data is never moved out to train anything | |
Can we see what each answer used? | Every answer carries its working and the sources it used | |
Can an answer be traced to source? | Yes: the plan, the SQL that ran, documents with page and excerpt, the logic and the validation grade | |
How are figures produced? | Figures are computed in code from your data and checked against their source before you see them, and Unloq would rather show nothing than a confident wrong answer | |
Is there human oversight of AI recommendations? | Yes. A person signs off every decision, and Unloq records the approval with the outcome you expected. A recommendation that would breach a limit you have set is flagged before you approve it | |
How is the AI tested? | Ask us for our testing figures | |
Are answers consistent? | Yes. Every metric resolves to one versioned definition your team owns before any query runs | |
What happens if we stop? | In your cloud, you keep your data, your definitions and Unloq’s outputs, and continuity terms can go in the contract | |
Which certifications are held? | Unloq holds Cyber Essentials Plus. We are working towards ISO 27001. SOC 2 and ISO 42001 are on the roadmap | This page |
Which questions should a reviewer ask first?
The published checklists are long. ThinkTech Research’s guide, published on 8 April 2026, sets out thirty questions in five categories and opens on model architecture, asking whether you are buying “a wrapper around GPT-4”. For a chatbot that is a fair place to start. For a tool that produces numbers, we think the first question belongs further down the stack: whether a figure came from a query, whether that query used an agreed definition, and whether anything checked the result before a person saw it.
We agree with ThinkTech’s fourth question, which asks a vendor for its known limitations, and with its view that a vendor claiming none “is either being evasive or has not tested thoroughly”. Ask us for Unloq’s known limitations on your first call, and expect a specific answer.
What this page does not cover
The platform overview shows the four layers of Unloq, from what happened to what it was worth, and the security pack request is where you tell us what your review needs, so our team can put the pack together and send it to you. Commercial terms are agreed with you directly.
Ask us your question
If your questionnaire has a line these pages do not answer, ask us your question. Our AI engineering team works the question through with our technical founders and replies with an answer.
Need this in writing for your review?
Request the security pack and tell us what your reviewer needs.
