Security and privacy
How Unyo protects your data: every table row-level protected, every OAuth token AES-256 encrypted, irreversible actions gated behind your approval, and a sandbox with no internet and no secrets. Verified against the live database on 2026-07-16.
You are about to give an AI access to your inbox, your calendar and your customers. That is a real decision, and "trust us" is not an answer to it.
This page is the specific version instead: what is enforced, where it is enforced, and what we deliberately do not do. Every number below comes from the live production database or from the code that runs it, checked on 16 July 2026.
The one-paragraph version
Your agents can only touch what their toolbox allows, and the toolbox is a runtime access control, not a suggestion in a prompt. Every OAuth token is encrypted before it reaches disk. Every table in the database is row-level protected, so no other user's session can read your rows. Anything irreversible — sending, publishing, deleting — stops and waits for you to click. And nothing an agent writes goes out on its own: Unyo drafts, you send.
1. Each agent has a boundary, and it is enforced
Unyo is ten agents rather than one chatbot, and that is a security design as much as a product one. Each agent gets a specific toolbox mounted at runtime, plus a denylist that removes tools it must never reach.
- Maya is the only agent with your inbox. Ashley cannot read your email. Not "is told not to" — the email tools are not mounted for her, so there is no call she can make.
- Blake and Tyron are the only agents who run code — Blake for real computation over your data, Tyron for pixel-exact image compositing. Steve is the only one who builds and publishes websites.
- The boundary holds at two layers: the prompt layer and the runtime layer. A model that hallucinated a tool name it isn't allowed to use gets an error, not access.
Why this beats a single all-powerful assistant
One assistant with every permission has a blast radius equal to everything you connected. Ten agents with narrow toolboxes means a bad instruction — or a prompt injection buried in an email — reaches at most one surface. The limit is the feature.
2. Nothing sends, publishes or deletes without you
17 tools are confirmation-gated, and the gate is database configuration, not a line in a prompt. A model cannot talk its way past it.
| Category | Gated actions |
|---|---|
| Send, schedule, delete | |
| Calendar | Delete an event, delete an entire calendar |
| Social | Publish to Facebook, Instagram, LinkedIn, X, and multi-platform publishing |
| Workspace | Post to Slack, archive a Notion page, delete a Trello card |
| Neural Core | Delete an entry |
Two things follow from this that are worth stating plainly:
- There is no auto-send. Not as a default you can change — it does not exist. Automations that run while you are asleep produce drafts waiting for you, never sent mail.
- Voice cannot send or publish. Ask an agent out loud for a post and you get a card. You tap the card. Speech is not a confirmation.
Draft, never send
This is the honest description of the product and also the stronger promise. If you were hoping for an AI that fires emails off unattended, Unyo is not it, and deliberately so.
3. Your tokens are encrypted, and the key is out of reach
When you connect Gmail, Outlook, Shopify or Stripe, the provider hands us tokens. Those are the crown jewels — anyone holding them is you, as far as the provider is concerned.
- Every access and refresh token is encrypted with AES-256 before it touches disk.
- Verified at the cipher-byte level on 2026-07-16: 17 of 17 populated token columns are AES-256 encrypted. Zero plaintext tokens exist in the database.
- The plaintext only ever exists in memory, for the duration of one API call.
- The master key is unreachable by any client role. It lives in a singleton table whose only access policy denies everything, readable exclusively through a function granted to the backend service role — not to logged-in users, not to anonymous callers.
4. Row-level security on 100% of tables
- 109 of 109 public tables have Row Level Security enabled, with 291 policies. Zero unprotected tables. (Live query, 2026-07-16.)
- The pattern almost everywhere is
auth.uid() = user_id: 273 of the 291 policies key on your authenticated user id. The other 18 cover shared reference data (pricing, tool configuration), service-role-only tables, and the public gallery — none of them hold your content. - The cross-tenant IDOR surface is empty. We ran the authoritative check — every privileged function callable by a logged-in or anonymous caller that takes a user id and skips an ownership check — and it returns nothing.
5. The sandbox has no internet and no secrets
When Blake runs Python, or Steve previews your site, it happens in a throwaway microVM.
- No network. Outbound internet is switched off at the sandbox level.
- No secrets. The environment allowlist is empty, so no key from our servers can physically enter it. On top of that, a secret-pattern denylist scans the code and refuses the run outright if it finds one.
- Destroyed, never paused. The sandbox that runs code is killed in a
finallyblock the moment the run ends. A site preview keeps its sandbox for a short window so the preview stays live, then it expires. Either way we never snapshot one, because a paused snapshot would persist — and persisted data you asked us to delete is a GDPR Article 17 problem. - Limits are checked before the sandbox is created, so a malformed run fails fast and is never billed to you.
6. Least privilege, with receipts
Most apps ask for everything and sort it out later. The interesting number here is what we gave back:
- 9 Google scopes → 5. We dropped the full-access mail scope entirely.
- We swapped broad Drive read access for per-file access via the official Google Picker — we see the files you hand us, not your Drive.
- Shopify is read-only by grant — all seven scopes are
read_*. - Stripe is read-only by construction. There is no charge, refund or payout code path in Unyo at all. Not disabled. Absent.
Scopes we could easily have taken and refused: LinkedIn email address, Slack file reading, the Trello account scope, and X's DM, follow and like write permissions.
Check it yourself
Every consent screen lists exactly what is being requested. Read it. If a permission on that screen looks broader than what the integration needs, we would genuinely like to hear about it — privacy@unyo.ai.
7. Your content does not train models
- Gmail, Drive and Calendar content is never used to train any AI model. Our Privacy Policy reproduces Google's four Limited Use clauses word for word — changing them is classified internally as a critical regression that blocks a release.
- Every model Unyo uses runs under a no-training guarantee. We do not name the model on this page on purpose: it is a configuration value, it changes as better ones ship, and the guarantee is what you should be buying. The current list of every subprocessor that can touch your data is published and versioned in §6 of the Privacy Policy, and it is updated before a new one is used in production.
- No human reviews your email content unless you open a support request about it.
- Your content is never exported to analytics, marketing or BI.
8. What we do not collect
Sometimes the shortest list is the useful one.
- No precise location. Country level only, and only to guess your timezone.
- No device fingerprints.
- No cross-site tracking.
- No analytics on your content.
- No sale of personal data. Ever, under any of CCPA/CPRA, GDPR or LGPD definitions.
9. Old data deletes itself
Retention is a cron job that runs, not a paragraph on a page. It fires daily at 03:00 UTC and is confirmed live in production.
| Data | Deleted after |
|---|---|
| Conversations (and everything attached to them) | 90 days of inactivity |
| Cached emails | 30 days |
| Technical logs | 7 days |
10. Deleting your account actually deletes it
Settings → Account → Delete my account. Three steps: a warning, typing DELETE, then a confirmation screen. What happens when you confirm:
- We revoke your OAuth grant at every provider that offers a revocation API.
- We take any website you published offline first, so nothing survives on the internet.
- We wipe your files from your storage buckets.
- A single atomic server-side function purges roughly 80 database tables in one pass.
- Your authentication record is removed.
It completes in under ten seconds in practice; the committed SLA is 30 days.
Four providers we cannot revoke for you
Microsoft, LinkedIn, Trello and Notion do not offer a revocation API. We cannot press the button on your behalf. So the final deletion screen lists exactly those providers with a direct link to each one's permissions dashboard — and it has no close button, so you cannot miss it. Deleting your Unyo account removes our copy of the token either way; the link is there so you can also remove the grant at their end.
And a deliberate design decision worth knowing: a broken provider can never block your erasure. Each revocation call is wrapped individually. If Google, Meta or Slack is down, your deletion still completes.
11. Independent testing
An independent CASA Tier 2 DAST was run by TAC Security on 6 May 2026: 0 Critical, 0 High, 0 Medium. Five Low and four Informational findings, all nine fixed or formally accepted with externally-verifiable evidence.
We also ran a full adversarial pre-launch audit on ourselves in July 2026 — live database probes plus multiple independent code auditors. It found real Critical issues. We fixed and deployed every Critical and High finding within 48 hours, including revoking anonymous access to token functions, injecting cross-tenant guards into 20 functions, retiring an OAuth callback with an unsigned state parameter, and adding DNS-resolving SSRF protection.
What we have not done yet — stated plainly
- Unyo is not "Google-verified" yet. Verification is in progress and not submitted, so Google's consent screen still shows an unverified-app warning. We are not going to pretend otherwise.
- We are built to CASA Tier 2 / OWASP ASVS Level 2 requirements, and the DAST above is real. But no assessor is signed, so we are not "CASA certified" and will not say we are.
- Unyo is not EU-hosted. Our infrastructure processes data in France, the EU/EEA, the United States and Canada, under the EU-US Data Privacy Framework and/or Standard Contractual Clauses. If EU-only residency is a hard requirement for you, Unyo does not meet it today.
- Data export is not self-serve yet. Your GDPR Article 20 portability request works — email
privacy@unyo.aiand you get an answer within 30 days — but there is no one-click export button. We are building it. - Two-factor authentication is on all administrator accounts. It is not yet available for end-user accounts. That is on the roadmap and we will not describe it as shipped.
12. Who is accountable
Unyo is operated by Unyo SASU, SIREN 104 459 391, RCS Paris, 6 Rue d'Armaillé, 75017 Paris, France. There is a named Data Controller, a working data-rights contact — privacy@unyo.ai — a 30-day response SLA on any request, and a documented escalation path to the CNIL, France's data protection authority.
How to check any of this yourself
- Look at the consent screen. When you connect a provider, read what is actually being requested. It will be narrower than you expect.
- Try to make an agent overstep. Ask Ashley to read your inbox. She will tell you she cannot — because she cannot.
- Ask for a send. Ask Maya to send something and watch the confirmation appear. Try to talk her past it.
- Disconnect something. Go to Integrations in the sidebar and disconnect a provider. Your tokens for it are purged immediately and every tool that used them stops working right away.
- Read the Privacy Policy's subprocessor list (§6). It is the complete list of every company that can touch your data.
That prompt fails on purpose. Ashley does not have the tools. Ask Maya instead.
FAQ
Can an agent send an email without me approving it?
No, and there is no setting that changes this. Sending, scheduling and deleting email are three of the 17 confirmation-gated actions, and the gate is database configuration rather than a prompt instruction — so no phrasing, no automation and no voice command bypasses it. Automations that run overnight leave you drafts, not sent mail.
Can another Unyo user see my data?
No. Row Level Security is enabled on 109 of 109 public tables with 291 policies, verified against the live database on 16 July 2026 — every table holding your content keys its policies on your authenticated user id. Cross-user reads are only possible with the backend service-role key, which exists solely inside our server functions and is never sent to a browser.
Is my email used to train an AI model?
No. Gmail, Drive and Calendar content is never used to train any model, by us or by anyone we send it to — every model we use runs under a no-training guarantee, and our Privacy Policy reproduces Google's four Limited Use clauses verbatim. Your content is also never exported to analytics or marketing, and no human reads it unless you open a support request about it.
What happens to my tokens if I disconnect an integration?
They are purged from our database immediately, and Unyo instantly loses all ability to call that provider's API for you. For four providers — Microsoft, LinkedIn, Trello and Notion — we cannot also revoke the grant at their end, because they publish no revocation API; the Privacy Policy §7.2 links you to each provider's dashboard so you can finish the job. For everyone else, deleting your account revokes the grant at the source too.
Is Unyo Google-verified or CASA certified?
Not yet, and we would rather say so than fudge it. Google verification is in progress but not submitted, so the consent screen still shows an unverified-app warning. On CASA: we are built to Tier 2 / OWASP ASVS Level 2 requirements and an independent DAST by TAC Security on 6 May 2026 returned 0 Critical, 0 High and 0 Medium findings — but no assessor is signed, so "certified" is not a word we will use.
Where is my data stored?
In France, the EU/EEA, the United States and Canada, depending on the subprocessor — transfers governed by the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Unyo is not EU-only hosted, and we will not market it as sovereign or EU-resident. The full list of subprocessors and processing locations is in §6 of the Privacy Policy.
Does the AI sandbox have access to my accounts?
The sandbox that runs Blake's Python and Steve's site previews has outbound internet switched off and an empty environment allowlist, so no credential from our servers can physically reach it, and a secret-pattern scan refuses the run if one appears in the code. The sandbox running code is destroyed the moment the run ends — killed outright, never paused, because a paused snapshot would persist data you may have asked us to delete. A site preview holds its sandbox for a few minutes so the preview stays live, then it expires.
Troubleshooting
"Unverified app" warning on the Google consent screen. Expected — Google verification is in progress. Click Advanced → Go to Unyo to continue, or wait for verification to complete if you would rather not.
A trust warning on the Microsoft consent screen. Same situation: Microsoft publisher verification is not complete yet.
An agent says it cannot do something you think it should. Usually the boundary working as designed — check whether you are talking to the agent that owns that surface. Email is Maya. Social is Ashley. Code is Blake. Websites are Steve.
An integration suddenly stops working. The provider probably revoked the grant at their end, which we detect and mark as disconnected. Reconnect from Integrations in the sidebar.
You want your data deleted right now. Settings → Account → Delete my account. It is immediate and complete. For anything short of that — access, rectification, restriction, portability, objection — email privacy@unyo.ai.
Related: Your data and deletion · How agents work · Gmail