Data, Privacy, and Security for UnqorkAI

UnqorkAI is Unqork's AI-first enterprise development platform with AI-assisted development, Smart Components, and Agentic Smart Components. This article describes how UnqorkAI processes data, where it is transmitted and stored, and the applicable retention periods.

For purposes of this article, "Customer" means the legal entity that has entered into an Agreement with Unqork for access to and use of UnqorkAI, which can include an Unqork customer, partner, vendor, or systems integrator.

Commitments and Responsibilities

• Unqork's Shared Security Responsibility Model applies to the development and deployment of use cases using UnqorkAI.

• UnqorkAI follows industry standard Secure Software Development Lifecycle (SSDLC) best practices.

• Customer prompts, data inputs, use case configurations, and JSON specifications are not used to train or fine-tune foundation or third-party large language models (LLMs) utilized by UnqorkAI.

• The Build Agent is powered by models accessed through Google Gemini Enterprise Agent Platform. For more information, see Models in Gemini Enterprise Agent Platform.

• For the purposes of the EU Artificial Intelligence Act, the following apply:

  • When Customer uses only the Build Agent, Unqork acts as the provider and Customer acts as the deployer.

  • When Customer deploys Agentic Smart Components using the Customer's own LLM, the Customer acts as both provider and deployer of the AI experience built by Customer. Customer is responsible for informing end-users that they are interacting with an AI system.

• Customers are responsible for determining their compliance obligations with the laws that apply to the use cases built and deployed with UnqorkAI. Unqork does not make regulatory determinations about, nor is it responsible for, the compliance of Customer use cases.

• Unqork's SOC 1, SOC 2 Type II, ISO 27001, and penetration test reports are available in the Unqork Trust Portal.

UnqorkAI at a Glance

UnqorkAI continues to evolve. For current capabilities, see the UnqorkAI Overview and Release Notes.

UnqorkAI has distinct AI capabilities with different data flows and LLM relationship owners. Keep these distinctions in mind when reading this article.

Build Agent Data Flow

Creator prompts to the Build Agent travel from the Creator's browser to Unqork's model provider. Prompt and response history stays in the Customer environment's database.

Agentic Smart Component Data Flow

Agentic Smart Components enable Customers to use Customer-provided LLMs in use cases to provide end-users with AI-powered experiences.

Data the Build Agent Accesses

When a Creator sends a prompt, the Build Agent can read the state of the module the Creator has open, including its component tree, settings, and connections. It might include that configuration as context for the request. It reads and changes only what the Creator's own role already permits, in the environment where the Build Agent is running.

The Build Agent does not access or process submission data from the database unless a Creator includes such data in a prompt.

How data is used by the Build Agent is subject to limitations. See Limitations.

Data to Exclude from Prompts

Build Agent prompt content is inspected by an AI guardrail before being sent to Unqork's model provider. If Customer handles sensitive data, the Creator must exercise caution and follow Customer's encryption and data-handling standards when preparing prompts and exports or otherwise using the Build Agent.

Do not include any of the following:

• Credentials, API keys, tokens, or passwords.

• Sensitive Personal Information (SPI), personally identifiable information (PII), or protected health information (PHI).

• Real end-user responses, form submissions, or other production data. End-users include customers, service providers, third parties, and other external users. Use synthetic, aggregated, or anonymized examples to describe data structure.

• Confidential business data or proprietary architecture details that are not meant to leave Customer's organization.

Data Storage and Retention

The Build Agent organizes work into Tasks. Each Task holds the prompt history, plan, and build activity for the Creator's sessions. Tasks save automatically and persist across sessions in the History tab. Creators can roll back module configuration, conversation history, plans, and tests to any earlier checkpoint.

LLM Training

Prompts, data inputs, use case configurations, and JSON specifications are never used to train or fine-tune foundation or third-party LLMs, and Unqork does not use Creators' inputs to improve the Build Agent.

Unqork has agreements with its model providers covering data transmission, security, privacy, and storage. LLM providers retain logs for trust, safety, and abuse monitoring for up to 90 days.

Customers remain responsible for maintaining a lawful basis for any personal data they process in UnqorkAI.

Data Protection

• LLM Proxy: The Build Agent requests are routed through a secure LLM Proxy that manages API credentials and prevents direct external access to the model.

• Local execution: The Build Agent actions run locally in the Creator's browser.

• Encryption: All data input into the Build Agent is encrypted in transit with TLS 1.2+ and at rest with AES-256.

• Access control: The Build Agent inherits role-based access control (RBAC) from the signed-in user's session. It has no privileges beyond that user's and it cannot access other environments.

• Guardrails: AI guardrails inspect prompts and responses input into the Build Agent against security baselines.  validation is protected against prompt injections, jailbreak attempts, harmful or unsafe content (like hate speech or dangerous material), malicious URLs, and threats embedded in attached documents. Violations are logged.

• Not present in production: The Build Agent exists only when building in non-production environments. Smart Components built in a non-production environment run in Production without the Build Agent.

Build Agent Autonomy

Creators control the autonomy of the Build Agent. By default, the Build Agent requires Creator approval to perform plan and build actions. For details, see Agent Configuration.

Agentic Smart Components and Customer LLMs

Creators can add Agentic Smart Components, currently the Chat Agent and AI Summarizer capabilities, to the use cases they build. These components are separate from the Build Agent. The provider's retention, training, and regional processing terms apply, so review them before deployment.

Customers, not Unqork, provide the LLM used in connection with Agentic Smart Components. When Customers use their own LLM with use cases created with UnqorkAI, data processed by the component is governed by Customer's agreement with that provider, not by Unqork's agreements with its providers.

LLM Compatibility

Agentic Smart Components support the following LLM providers: Google Gemini Enterprise Agent Platform (formerly Vertex AI), Amazon Bedrock, Microsoft Azure, and Anthropic.

To reduce risk when using Agentic Smart Components, follow these practices:

• Map only the fields the component needs. Do not pass PII, PHI, or credentials to an LLM unless the provider agreement and Customer policies permit it.

• Use Customer's controls for encryption, network isolation, content filtering, and logging, and apply the organization's encryption standards.

• Use RBAC to limit who can configure and use these components.

• Add validation or human review steps where an AI-generated result affects a decision about a person.

Trust and Safety

• Governed by design: The Build Agent maps requirements to proven, security-tested Smart Components, the same components every module in the environment uses. Behavior stays predictable across Customers' use cases.

• Review before deployment: The Build Agent is a configuration assistant. Creators review, refine, and approve output before it is used in the configuration of use cases, and Creators can add validation, review, and sign-off steps.

• Automated testing: The Build Agent creates and runs test plans and produces a Test Execution Report when a build completes. Tests are saved in Test Case Management, where Creators can edit, run, or add tests, and use cases move through standard multi-environment pipelines.

• Explainability on demand: The Build Agent can answer questions about the logic, data, and configuration of a use case.

• Model flexibility: Unqork continuously evaluates available LLMs to identify those best suited to be used for the Build Agent in terms of performance, speed, and efficiency.

Compliance and Control

UnqorkAI is built on Unqork's existing security, privacy, and compliance commitments.

• Certifications and reports: SOC 1, SOC 2 Type II, ISO 27001, and penetration test reports are available on the Unqork Trust Portal.

• Human review: Creators approve every generated output, and Customers can configure validation checks and sign-offs to meet their own standards.

• RBAC: Access to UnqorkAI features and to Customers' data follows the platform's existing role-based access model.

• Audit: Use existing platform audit logs to monitor activity.

Frequently Asked Questions

Which Models Power the Build Agent?

The Build Agent is a proprietary agentic tool that coordinates leading third-party LLMs, accessed through the Google Gemini Enterprise Agent Platform. Unqork evaluates models continuously and can change them as the best option changes.

Can Customers Choose the Build Agent Model?

No. Unqork selects the LLM used by the Build Agent. Customers provide the LLM for the Agentic Smart Components.

Does the Build Agent Run in Production?

No. It is present only while building in a lower environment. Smart Components created in a lower environment run in UAT and Production without it.

Can the Build Agent Promote Code?

No. Customers use configuration and promote use cases according to their own governance controls.

Does UnqorkAI Change Existing Production Use Cases?

UnqorkAI does not change the existing functionality of use cases configured prior to using UnqorkAI.

Can the Build Agent Delete Configuration?

By default, every change it makes requires review and manual approval, and it is bound to the user's RBAC session. Version history lets Creators revert to an earlier configuration. If Creators choose automatic approvals, it can delete without asking.

Can the Build Agent See UAT or Production?

No. It is limited to the active user's session and permissions in the environment where it is running.

Do Prompts Leave Unqork's Environment?

Yes. Prompts pass through the LLM Proxy and an AI guardrail to Unqork's model provider.

Where Are Security Review Documents Available?

Visit the Unqork Trust Portal, or ask your Customer Advocacy Manager, who can bring in the Unqork Security Team.

Is UnqorkAI Compliant with the EU AI Act?

Yes, Unqork is compliant in its capacity as a "provider" under the EU AI Act. Unqork cannot warrant compliance on behalf of customers. Customers are responsible for the compliance of the use cases and Agentic Smart Components deployed, including end-user disclosures and any laws governing AI-informed decisions about individuals.

U.S. state AI laws are evolving and vary by use case and by role.

For questions, contact your Customer Advocacy Manager.