Security & SLA
Security responsibilities, incident reporting and contract-specific service levels.
Last updated: 15 November 2026.
Scope and shared responsibility
Security requirements depend on the selected product, hosting arrangement, integrations and customer agreement. UIB uses a risk-based approach to protect information and maintain service integrity. Customers must protect credentials, manage authorised users, configure integrations appropriately and maintain lawful instructions. This public notice is not a certification, audit report or substitute for an agreed security schedule.
Security measures
For a contracted deployment, the security schedule should specify relevant access controls and least-privilege permissions, confidentiality obligations, encryption in transit and where applicable at rest, logging and monitoring, vulnerability management, backup and recovery arrangements, and incident handling. Ask UIB to confirm the controls and evidence applicable to your deployment. Do not assume that every product, third-party channel or self-hosted installation has identical controls, data residency or certifications.
Service levels
Uptime targets, measurement methods, exclusions, planned maintenance, support hours, response targets, service credits and claim procedures are defined in the applicable Transaction Documents or signed SLA. The public website does not grant a universal uptime percentage, response-time guarantee or credit entitlement. Third-party networks and customer-controlled infrastructure may have their own availability conditions.
Incidents and data protection
UIB investigates reported incidents and coordinates corrective action with affected customers under the applicable agreement. Personal-data breach notifications and assistance follow the agreed DPA and mandatory law. A service incident is not necessarily a personal-data breach. Do not submit confidential incident details through public enquiry previews.
Responsible vulnerability reporting
Report a suspected vulnerability to security@uib.ai with affected addresses, a reproducible description and your contact details. Avoid including live personal data or secrets. Do not exploit a vulnerability beyond what is necessary to demonstrate it, access another user’s information, disrupt availability or publicly disclose sensitive details before coordinated handling. This notice does not authorise penetration testing or promise a bounty or legal safe harbour; obtain written permission before active testing.