Boundaries are not a matter of discipline
We build infrastructure, so security is not an add-on but part of the product form. This page states exactly what we have done, where the boundaries are drawn, and which conclusions need to be confirmed per project.
Six non-negotiable lines
Whichever business line or delivery model, these six apply. Each is annotated with where it is implemented, so you can verify instead of taking our word for it.
Any constraint that can be baked into the compiler, the framework or the query layer does not go into a document for people to remember. Tenant isolation is enforced by a query-layer listener; domain boundaries are rejected at compile time by Go’s internal mechanism.
jOOQ TenantScopeVisitListener · Go internal 墙Sensitive data stays on the user device or inside the customer network by default. All four business lines support private deployment, and legdger does not even send AI analysis off the device.
legdger 端侧 AI · Uniclaw 自建 Milvus · Unilearning 单容器Agents never share human credentials, servers never hard-code long-lived keys, and endpoint integrations use revocable tokens. Any credential can be revoked on its own without affecting other principals.
UIAM MACHINE 主体 · OSS STS AssumeRole · ledger-cli 令牌Authentication, authorization, tool calls and captured traffic all produce structured records. We keep them not for compliance theatre but so that incidents can be replayed.
uiam-audit · collaboration-logger · pxc 会话记录Delegation is expressed with the act claim — who acts for whom — with permissions intersected at every hop. Audit can answer which user authorized which agent, which tool it called, and with which permissions.
RFC 8693 Token Exchange · agent_tools 注册表Database changes go through versioned migrations that produce the same result on repeat; application releases are single-image swaps, so rollback means switching back to the previous image.
Liquibase · 各域方言迁移 · Docker 单镜像Where the data stops
The data boundary is determined by the product form, not by a toggle someone can flip. We split it into three layers, and what may live in each is spelled out.
The minimum boundary for endpoint products. Data at this layer has no upload path by design — it is not switched off by a toggle.
- All legdger ledger data: encrypted locally, only ciphertext reaches the cloud
- legdger on-device AI statistics and Q&A: inference runs on the device
- NewTool desktop and wasm forms: the algorithm kernel has no IO, so data never leaves the process
- pxc captured traffic: the kernel runs locally and does not pass through third-party services
The boundary for private deployment. Models, vectors, business data and audit records are all deployed inside the customer’s own network.
- Uniclaw memory and knowledge vectors: self-hosted Milvus, never leaving the intranet
- Uniclaw model services: can connect to privately deployed compatible-protocol services
- UIAM identity and audit data: the whole deployment sits inside the customer boundary and can run fully air-gapped
- Uniscrm assets and media: object storage can connect to the customer’s own OSS
- Unilearning courseware and learning records: delivered as a single container, with data under the customer’s control
The only things needing external network access are sync and external channels, and what travels is ciphertext or already-desensitised messages.
- legdger cross-device sync: uploads only the latest ciphertext, and the server keeps no history
- Uniscrm WeCom channel: communicates with official WeCom interfaces and uses official archiving capability
- Uniclaw channels: Feishu / DingTalk push APIs, with content isolated per tenant
- NewTool remote calls: transported over MCP, while the algorithm kernel itself makes no network requests
Compliance mapping
Common compliance requirements on the left, our concrete supporting points on the right. This table describes capabilities already implemented in the product, not certification claims — certification materials are provided with the delivery project.
uiam-audit · audit event streamuiam-authz · maxPermissionLevelemployee lifecycle automationuniscrm-msgaudit · employee consentuniscrm-riskctl · ContentAuditdelivery forms across the four business linesuiam-protocol-core · OSS STS · ledger-cli tokenLiquibase · unile_migrationsSecurity habits on the engineering side
These habits are not written in a security whitepaper — they are written into commit conventions and the build pipeline.
No dependency is introduced where the standard library would do. Unilearning’s LLM client implements the OpenAI-compatible protocol with the Go standard library alone — zero new dependencies.
Once released, a database migration file is never modified; new versions are appended only. This prevents “works locally, differs in production”.
NewTool uses build.rs to compare the manifest against the code at build time; drift fails the build outright. Checks like this live in CI, not in documents.
A tool’s visibility, parameters and effective forms are declared in tool.toml; the manifest is the single source of truth, and code comments are not evidence.
The tenant-filter bypass path (runAsSystem) itself produces an audit record — anything that can bypass must leave a trace.
When a tenant predicate is missing, the default is to write a security log as configured or throw outright; risk events are flagged separately at SECURITY / FAILURE level.
Security capabilities by business line
Each business line’s detail page lists its own security items and where they are implemented.
This page describes security capabilities and compliance supporting points already implemented in the product; it is not a statement of any certification or compliance conclusion. Certification materials, penetration test reports and compliance conclusions are provided by the delivery team with the delivery project. For regulated scenarios, we recommend adding compliance requirements to the requirements list during solution design — we adjust the implementation accordingly rather than patching documents afterwards.
Hand the complexity of identity, agents and private domain to one governable kernel
Whether you are replacing an existing IAM, building an agent platform, or trying to make private-domain operations actually work — start with a 30-minute architecture call. We will first judge whether this is the kind of problem we are good at, and say so plainly if it is not.