Security philosophy
Good security starts with good engineering.
No security through obscurity
Most organizations keep their security posture behind closed doors. This page is how we operate, what we prioritize and where we draw the line.
01Delete the attack surface
Adding more tools, policies and layers of complexity does not solve security. It starts with removing what should not be there in the first place.
We approach security the way we design networks: delete first, then simplify. Fewer systems, data paths and vendor dependencies mean fewer things that can go wrong.
No organization can guarantee it will never be breached, and neither can we. What we can do is keep the surface where one could occur small, and be ready to respond when someone tries.
Delete unnecessary data paths. If data does not need to travel somewhere, it does not. We limit API connections to client environments, restrict data sharing with vendors, and eliminate transmission paths that serve convenience over security.
Delete unnecessary data. We are a network engineering firm, not a data business, and we do not collect information we do not need. When a client engagement ends, we terminate connectivity and destroy data we are not legally obligated to retain, typically within 90 days.
Delete unnecessary access. Least-privilege access is our default. Engineers get the minimum access the engagement requires, and when the engagement ends, so does the access. Defined retention and termination policies enforce it.
Delete unnecessary cloud dependencies. We keep external cloud exposure to a minimum and are migrating internal systems onto private cloud compute and our own infrastructure. Cloud is not inherently bad; fewer external dependencies mean less external risk.
02Simplify the policy
Our security policy runs to fewer than ten pages. Every employee, and every partner with access to sensitive information, knows it and follows it.
A policy is only useful if people read it and follow it. Ours is short enough to know by heart and specific enough to act on.
03Security by design
We write much of our own internal software. When customer data is at stake, security comes before performance, and before reliability too.
Security is a constraint we design around from the first architecture decision, so it is never bolted on after the system works.
04Wisdom over compliance
A compliance framework sets the minimum. Deciding what is actually safe takes judgment.
We maintain a policy of not using providers with repeated, poorly handled security incidents. If a subprocessor has demonstrated a pattern of security failures or a culture of inadequate response, we will not integrate them into our operations.
Every vendor faces threats, so we do not expect perfection. We look at how a vendor responds, how it communicates and whether it has earned continued trust, and we act on it when the answer is no.
AI security
AI speeds up our work, so we control what it can see and what it can do.
Our position on AI
AI lets us work faster and go deeper than we could without it. It also brings a category of risk that many organizations have not fully addressed.
AI models can read company information, execute code and talk to the public. A misunderstanding, misconfiguration or misuse can expose data as effectively as an attacker. We treat AI like every other part of our infrastructure: delete unnecessary risk, simplify the controls, and never assume a tool is safe because it is useful.
The models, and where the data goes
We use several models, some hosted by their makers and some run by us, and the list changes as the models do. We do not publish it.
Two rules do not change. A hosted model runs only with a provider in the United States, under terms that exclude our data from training: what we send is processed and discarded, not retained or learned from. Any other model runs on infrastructure we control, where the data never leaves.
The model is an engineering choice, made per task. Where the data goes is not a choice.
Logical segregation
AI models used for different purposes are logically separated from each other and from data they have no reason to access.
A model that assists with network design or infrastructure planning runs in an environment segregated from client-sensitive data, credentials and internal security systems. The separation is at the file system and infrastructure level as well as the model training level.
Models and applications we use internally are not publicly accessible. There is no shared boundary between an internal AI tool and anything facing the outside world.
Adversarial input & prompt integrity
AI models are susceptible to prompt injection: crafted inputs designed to manipulate model behavior, bypass instructions or extract information the model should not disclose. We treat it as an active threat vector.
Wherever a model interacts with a data source, internal or client-adjacent, we apply input validation, output filtering and context boundaries to limit what adversarial input can do. No model in our environment assumes its input is trustworthy.
AI-driven threat monitoring
We use AI to continuously monitor internal and external communication channels (email, Slack and software applications) for anomalous behavior, potential threats and indicators of compromise. It is threat detection and security monitoring, not surveillance: the aim is to catch patterns a person reviewing logs would miss, while there is still time to act.
Corporate security
How we protect our internal systems, client data, and operational infrastructure.
01Access control & identity
All internal systems at Unified IT operate under a least-privilege access model. Role-based access controls (RBAC) are enforced across every platform we operate, and multi-factor authentication (MFA) is mandatory for all personnel.
02Network security
Our internal infrastructure runs only on UniFi, built to the same standard we deliver to clients. Every network we operate runs CyberSecure IDS/IPS, using Proofpoint's ET Pro ruleset and Microsoft Active Protections Program threat intelligence for signature-based detection across all traffic. Gateway firewall policies, zero-trust VLAN segmentation, DNS filtering and content control are part of the baseline configuration. Remote access goes through dedicated UniFi VPN servers; there are no third-party remote access tools in our environment.
All site-to-site connectivity runs over UniFi SD-WAN, encrypted end to end. Firmware, configurations and backups are managed centrally from one console. Our own network is the reference deployment for every architecture we design.
03Authentication & password policy
Administrative credentials have a 48-character minimum.
We do not publish our other current requirements. For context, in 2019 our policy required 12-character minimums for standard accounts and 14 characters for accounts with access to sensitive systems, when much of the industry still considered 8 characters adequate. Our standards have only increased since.
If a service that will handle customer data does not allow us to enforce our password policies, we do not use that service.
Multi-factor authentication is enforced on every service that supports it. With one exception (Apple), we do not use critical services that lack TOTP or another authentication method beyond SMS.
Passwords are managed centrally through a provider with an independently verified security track record; we do not name it publicly. Every credential is tagged and segmented so client data is never stored alongside corporate credentials, and we enforce that separation.
Credentials are never sent by email. We share sensitive information over end-to-end encrypted channels, so no password sits in an inbox for years.
04Device & endpoint security
All company-owned machines are enrolled in mobile device management, which enforces full-disk encryption at rest on every device without exception.
On servers, we encrypt the data that is client-sensitive or operationally critical. Not every file is treated the same.
Our HR policies extend security expectations to employees' personal devices. If a personal device has indirect access to company material, even through email or messaging, we require alphanumeric passwords and baseline security configurations on it.
05Employee security
We also reduce our team's personal attack surface. Employees get cybersecurity monitoring and a personal data removal service that finds exposed personal information and issues takedown requests. The harder it is to profile and target our people, the harder it is to reach our systems.
We run regular security awareness training, much of it for compliance reasons. The security culture itself comes from the daily practices described in this Trust Center, not from an annual training module.
06Disaster recovery & business continuity
Critical data is kept as four encrypted copies in geographically separate locations, and every backup is encrypted end to end.
We also back up our cloud services independently. Email and collaboration run on Google Workspace, and we do not let any single provider hold our only copy: we pull that data and back it up on-premises, at a facility geographically separate from where any employee works.
Non-critical business data follows a standard three-copy backup model with encryption.
Our disaster recovery plan assumes the provider fails and the data center fails, and makes sure the data survives both.
National security
Unified IT is an American company that builds infrastructure, and we take the responsibility that comes with that seriously.
01Why this matters
We design, build and manage network infrastructure. For many of our clients, particularly in operational technology, critical infrastructure, defense and government, that infrastructure is inseparable from national security.
We treat that as a personal obligation. Everyone at this company is a patriot, and we take the security interests of the United States as seriously as any engineering decision we make.
02Our position
We serve clients globally, and will work with any organization that needs network infrastructure designed and deployed with integrity, wherever it is headquartered.
Under no circumstances will we engage in business that could threaten or compromise United States national security. That means:
Foreign adversary hardware. We will not sell, promote, distribute, or deploy network equipment manufactured by foreign adversaries into American infrastructure. If it did not come from a manufacturer we trust with our own network, it is not going into yours.
Adversarial engagements. We will not engage in any business relationship with a nation or entity that is at war with the United States, or where we believe the engagement poses a direct national security risk.
Foreign AI providers. We do not send our data or a client's to an AI provider outside the United States. A model that is not run by an American provider runs on infrastructure we control, and nothing leaves it.
Foreign internal technology. We will not use foreign technology anywhere in our internal infrastructure. Our networking, compute and communications run on technology from manufacturers and providers we trust, vetted against the standards described in this Trust Center.
03Network-level enforcement
We block traffic from foreign adversary nations across our infrastructure, including local, WAN and corporate networks. A VPN can get around geographic blocking, and we do not pretend otherwise; the block is one baseline layer in a broader defense, not a standalone control.
These controls are enforced across all corporate infrastructure and are part of the network security standards our CISO oversees directly.
04Working toward CMMC
We are working toward NIST and CMMC compliance alignment for our clients in defense and government.
05Our responsibility
We build the networks that businesses and institutions depend on. Some of those networks support operations that matter to the security of our country. We do not take that lightly, and we do not separate our business interests from our responsibility as Americans.
Sub-processors & vendors
The third-party platforms and services Unified IT uses internally.
We vet every vendor in our stack against the same standards we hold ourselves to. The following platforms have access to or process data within Unified IT's operations. Click any vendor to view their security documentation.
Productivity & Collaboration
Infrastructure & Cloud
Network Hardware
Other Platforms
Last reviewed: October 27, 2026. If you have questions about a specific vendor or data handling practice, contact us directly.
Confidentiality & NDA
Some of our best work is work we will never talk about.
01How we operate by default
Discretion is our default for every client. Every engagement is treated with a degree of confidentiality that most organizations would consider above standard.
If you need additional non-disclosure protection, we will work under your NDA or provide ours, whichever gives you greater confidence.
02Heightened discretion engagements
When a client requires heightened discretion, we flag the engagement in our internal applications. The flag stays visible to every team member with access, marking the project as carrying confidentiality requirements beyond our defaults.
National Defense Authorization Act (NDAA)
We deploy infrastructure built by manufacturers we trust, and that the United States government has cleared for use.
01What is NDAA compliance?
The NDAA prohibits U.S. federal agencies, and in many cases their contractors, from using telecommunications and surveillance equipment from manufacturers deemed national security risks, including Huawei, ZTE, Hikvision and Dahua. These manufacturers operate under legal frameworks that can compel them to cooperate with foreign intelligence services. A firmware update pushed to your cameras or network equipment could introduce a backdoor into your infrastructure without your knowledge or consent.
Government is not the only buyer that cares. Organizations in defense, critical infrastructure, healthcare and finance increasingly treat NDAA compliance as a baseline procurement standard. UniFi networking and Protect camera systems are NDAA-compliant across the full product line, so you can deploy a complete network and physical security infrastructure without exposing your environment to a foreign government's legal authority.
02Our position
All networking, surveillance and access control equipment we deploy is NDAA-compliant. We do not specify, procure or install equipment from prohibited manufacturers.
This applies to every component where NDAA compliance is relevant and verifiable: firewalls, switches, access points, security cameras, NVRs, and access control hardware. These are the categories the NDAA was written to address, and these are the categories where we enforce it without exception.
Our primary infrastructure platform is Ubiquiti (UniFi), which is NDAA-compliant. When we deploy other manufacturers' equipment we verify NDAA compliance before procurement.
03Why it matters
The equipment on your network is your responsibility. A camera from a prohibited manufacturer is a device that can be compelled to serve a foreign government's interests from inside your building. That risk does not disappear because you are not a federal contractor.
We do not deploy equipment that introduces that problem. Every UniFi product we install is NDAA-compliant.
HIPAA Security Rule
We comply with the HIPAA Security Rule. Our actual security standards exceed it.
01What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards for protecting sensitive patient health information. For IT and infrastructure, the relevant component is the HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164), which requires administrative, physical, and technical safeguards for electronic protected health information (ePHI).
Any organization that creates, receives, maintains or transmits ePHI is subject to HIPAA, and any vendor that handles ePHI on its behalf must operate under a Business Associate Agreement. For healthcare providers, health plans, clearinghouses and the vendors that touch patient data, HIPAA compliance is federal law, and violations carry significant civil and criminal penalties.
02Scope of our HIPAA obligations
Unified IT's HIPAA obligations fall under the HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164), which governs the protection of electronic protected health information. This is the component of HIPAA relevant to IT infrastructure and the work we perform.
03Business associate agreements
When we engage with healthcare organizations, we execute a Business Associate Agreement before any work begins. If a third party is brought into an engagement where PHI exposure is possible, we require them to execute a BAA with us as well.
In most engagements our access to PHI is indirect: we do not handle patient records. On occasion we may have direct access. In the rare case we must share PHI with a subcontractor, the BAA chain is maintained without exception.
04Compliance officer & safeguards
Our CISO serves as our designated HIPAA Compliance Officer, as required. We maintain information security policies that meet all administrative, physical, and technical safeguard requirements of the Security Rule.
05Beyond baseline compliance
Our security standards far exceed what HIPAA requires. HIPAA is fundamentally a documentation and compliance framework rather than a security framework, so meeting it is a baseline. The encryption standards, access controls and incident preparedness described in this Trust Center go well beyond what the Security Rule asks for.
SOC 2 alignment
Supporting SOC 2 readiness through network design that maps to the Trust Services Criteria.
01What is SOC 2?
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates an organization's information systems against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
02Our status
Unified IT is working toward a SOC 2 Type II report. We do not have one yet. The gap is administrative, not operational.
The security controls, access policies, encryption standards and monitoring practices described in this Trust Center already meet or exceed what SOC 2 requires. What remains is the formal audit and aligning our documentation with the Trust Services Criteria. That work is underway.
If SOC 2 compliance is a requirement for your organization, talk to us.
ISO / IEC 27001
The international standard for information security management systems (ISMS).
01What is ISO 27001?
ISO/IEC 27001 is the international standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it provides a systematic approach to managing sensitive company and client information through risk assessment and security controls defined in Annex A.
Certification shows clients, regulators and partners that an organization has implemented an independently audited framework for protecting information assets.
02Our status
Unified IT is currently working toward ISO 27001 alignment. This effort is underway alongside our broader compliance roadmap, including SOC 2 and NIST CSF.
Many of the controls Annex A requires (access control, cryptography, operations security, communications security and supplier management) are already part of how we operate, and the practices in this Trust Center reflect them.
What remains is the formal ISMS documentation, internal audit process, and certification engagement. We will update this page as we reach each milestone.
NIST Cybersecurity Framework
We are aligning with it. The framework matches how we already think about security.
01What is the NIST Cybersecurity Framework?
The NIST Cybersecurity Framework (CSF), developed by the National Institute of Standards and Technology, is a voluntary framework that provides organizations with a structured approach to managing cybersecurity risk. The current version, CSF 2.0, is organized around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Unlike prescriptive compliance standards, NIST CSF is risk-based. Instead of telling you exactly what to do, it gives you a structure for deciding what is appropriate for your environment, threats and risk tolerance. Government, defense, critical infrastructure and private industry use it as a common language for cybersecurity posture. Organizations that work with federal agencies or defense contractors are increasingly expected to align with it, and for many it is a prerequisite for doing business.
02Our alignment with NIST CSF
Unified IT is working toward formal alignment with the NIST Cybersecurity Framework (CSF 2.0). We chose NIST CSF as our target framework because its structure reflects how we already approach security operationally.
Much of what CSF requires is already embedded in how we operate. The controls, monitoring, incident preparedness, and risk management practices described across this Trust Center were built with NIST CSF principles in mind. Formal alignment and documentation are in progress.
For clients in defense, government, or critical infrastructure who require NIST-aligned partners, we will tell you where we are in the process and what our current posture covers.