Vulnerability and risk management

Vulnerability assessment

Union.ai maintains a comprehensive vulnerability management program that includes dependency analysis and automated alerts for known CVEs in software dependencies, container image scanning for both platform and customer-facing components, and periodic third-party penetration testing to identify potential attack vectors.

Patch management

Union.ai follows a risk-based approach to patch management. Critical vulnerabilities (CVSS 9.0+) are prioritized for immediate remediation, while high-severity vulnerabilities are addressed within defined SLA windows. The control plane is updated independently of customer data planes, ensuring that security patches can be applied rapidly without requiring customer-side changes. The customer is responsible for data plane patching (K8s version, platform components, monitoring stack).

Threat modeling

Union.ai’s architecture has been designed with the following threat model considerations:

Control plane compromise

In the event of a control plane compromise, an attacker would gain access to orchestration metadata only. They would not obtain customer data payloads, secret values, code bundles, container images, or log content. The attacker could not initiate connections to customer data planes (outbound-only tunnel). Presigned URLs are generated on the data plane, so the attacker could not generate data access URLs.

Tunnel interception

The Cloudflare Tunnel uses mTLS, making man-in-the-middle attacks infeasible. Even if an attacker could intercept tunnel traffic, customer data flowing through the tunnel (logs, secret creation requests) is encrypted in transit and is not cached or stored at any intermediate point.

Presigned URL leakage

If a presigned URL were leaked, the exposure is limited to a single object for a maximum of one hour (default configuration). URLs grant only the specific operation requested (GET or PUT) and cannot be used to enumerate or access other objects. Organizations can configure shorter expiration times to further reduce this risk window. Because presigned URLs are bearer tokens—possession alone grants access with no additional auth—Union.ai recommends that customers treat presigned URLs with the same care as short-lived credentials and configure the shortest practical TTL for their use case.

Security architecture benefits

Union.ai’s architectural decisions provide inherent security benefits that reduce overall risk exposure:

Architectural Decision	Security Benefit	Risk Mitigated
Control plane stores no customer data	Minimizes blast radius of CP compromise	Data breach from CP attack
Outbound-only tunnel	No inbound attack surface on customer network	Network intrusion via open ports
Presigned URLs for data access	No persistent data access credentials	Credential theft / lateral movement
Write-only secrets API	Cannot exfiltrate secrets via API	Secret leakage via API abuse
Workload identity federation	No static credentials on data plane	Static credential compromise
Per-org database scoping	Enforces tenant isolation at data layer	Cross-tenant data access
Cloud-native encryption	Leverages provider-managed encryption	Data at rest exposure

Third-party dependency risk

Union.ai’s architecture depends on a set of core third-party services. This section provides a risk-tier classification of these dependencies and the mitigations in place for each.

Dependency	Tier	Role	Mitigation
Cloudflare	Critical	Tunnel connectivity between control plane and data plane	mTLS encryption, outbound-only architecture, health monitoring, automatic reconnection
AWS (control plane)	Critical	Hosts control plane infrastructure (RDS, EKS, S3)	Multi-AZ redundancy, automated failover, encryption at rest and in transit
Customer cloud provider	Critical	Hosts data plane infrastructure	Customer-managed; Union.ai provides guidance and tooling
Vanta	Operational	Continuous compliance monitoring	Independent SOC 2 audit validates controls
Okta	Operational	Identity provider for OIDC authentication	Standard OAuth2/OIDC; API keys and service accounts provide fallback

Union.ai’s vendor management program, covered under the SOC 2 Type II audit, includes periodic evaluation of third-party providers. A formal dependency risk assessment document is available upon request for customers conducting in-depth supply chain reviews.

The customer owns all data plane dependencies. Union.ai’s dependency risk scope is limited to the control plane and Cloudflare tunnel.