Unplex is built for legal and financial professionals who process confidential client data. Every layer of the platform — infrastructure, contracts, access controls, and AI model behaviour — is designed to meet the security and confidentiality requirements of regulated professional environments.

ISO 27001:2022 certified. The certificate is publicly available at unplex.ai/trust-center.

Swiss nDSG compliant. A data processing agreement (Auftragsbearbeitungsvertrag / ABV) is a standard component of every contract.

GDPR compliant. A Data Processing Agreement under Art. 28 GDPR (AVV) is included as standard and publicly available at unplex.ai/legal/data-processing-agreement.

For Swiss law firms, Unplex recognizes the attorney-client privilege under Art. 321 StGB as a binding compliance framework. A dedicated confidentiality agreement under Swiss professional law (BGFA) is available for download and is signed before any pilot begins. This positions Unplex as an auxiliary of the law firm within the meaning of professional secrecy.

For German law firms, an equivalent agreement under BRAO is available.

Unplex offers three deployment tiers, described in full in Deployment Options: Standard, Swiss-Only Routing, and Self-Hosted:

Standard: platform hosted on Infomaniak, Switzerland; AI inference runs on infrastructure partners in the EU/EWR, on pseudonymized text only. This is the default for most customers.

Swiss-only routing: same Swiss-hosted platform, with AI inference additionally restricted to Swiss-hosted models.

Fully self-hosted (on-premise): the software is installed and operated on the customer's own infrastructure, under a separate On-Premise Addendum to the Unplex Terms and Conditions. The customer connects and operates their own AI models; Unplex has no access to the installation and is not a data processor for data held in it. Typically used by public sector bodies under cantonal data protection law.

Across the Standard and Swiss-only tiers, no data is processed outside Switzerland or the EU/EWR. Sub-processors and their locations are publicly listed at unplex.ai/trust-center. Current sub-processors include Microsoft (AI models, EU/EWR), Amazon Web Services (AI models, EU/EWR), Mistral (AI models, EU), and DeepL (translation, optional, EU).

For the technical detail on pseudonymization and the regulatory basis for the Standard and Swiss-only tiers, see Data Residency in Switzerland.

Client and matter data is never used to train or improve AI models — by Unplex or by any sub-processor. This is contractually guaranteed in the ABV/AVV and technically enforced through the account isolation controls described in Section 6. There are no exceptions. This does not apply to the fully self-hosted tier, where the customer operates its own AI models independently of Unplex.

Every operation is scoped to the requesting firm's account through mandatory access controls enforced at the application and database-query level: one firm's data cannot be accessed by, or influence outputs for, another firm. Dedicated and fully self-hosted deployments additionally run on physically separate database and storage infrastructure — see Deployment Options.

SSO is supported via SAML/OIDC (Microsoft 365, Google Workspace). Two-factor authentication is mandatory for all accounts. Role-based access control (RBAC) applies at both workspace and project level. See Account Roles and Project Roles for details.

Unplex regularly completes IT security questionnaires for law firms and financial institutions. If IT or compliance documentation is required, contact security@unplex.ai or visit unplex.ai/trust-center.

Related articles: How Unplex Prevents AI Hallucinations · Data Residency in Switzerland