Uniphore Help Center Portal

Maintaining uninterrupted operations and reliability in cloud environments is not only essential but also a critical competitive advantage. High Availability (HA) strategies play a pivotal role in ensuring that systems and applications can withstand failures and disruptions without significant impact on services.

Uniphore has a detailed Business Continuity Plan (BCP) to establish a comprehensive framework for effectively responding to disruptions and ensuring the continuity of business operations. As a Software as a Service (SaaS) company, Uniphore faces unique challenges related to maintaining service availability and protecting customer data. This plan aims to minimize the impact of potential risks, including security threats, data loss, and service disruptions, by providing clear guidelines and procedures for response and recovery.

Some quick highlights of Uniphore's High Availability and Disaster Recovery include:

Data storage management for Communication Recording Agent is relatively straight forward, typically Communication Recording Agent includes 3 months of warm storage (~instant access to recordings) and 9 months of cold storage (delayed access to recordings, generally within 12 hours), which includes the audio, transcription, and screen recording (if purchased), however it's worth noting that your solution design may vary. Additional warm and/or cold storage can be purchased if longer retention is required. If you would prefer to store your recordings in your own storage locations (including non-cloud storage locations) or in regions not currently supported by Uniphore by default then Storage policies can be configured so that your recordings are streamed to alternate storage locations.

Setting up alternate or additional storage locations for your recorded calls is manageable within the application. It's worth noting that Endpoints can be configured to define a location for call exports to send captured data to.

Storage Locations:

Communication Recording Agent makes use of cloud storage to store your captured data (Audio, Metadata, transcriptions). Storage locations can be defined to provide additional “hot, warm, or cold storage” facilities and flexible archiving options. Combined with the Policy Engine features, these provide an extensive archive and storage policy capability to automatically move data between storage facilities for archive purposes.

For example, you may need to keep recent calls readily available for review, whereas older calls may only need to be kept for compliance purposes. Using automated storage policies, you can move your captured data from a "hot" storage location to a cheaper cold storage location when the captured data matches a specific condition set in a storage policy filter.

Endpoints:

Endpoints are a way of defining a location to export captured data to. Once a data Endpoint is configured, using either the Webhook or Real-time Stream (Socket) Export Channel, automated export policies can be set up to export stored or live data (media, metadata, transcriptions). Using these policies, you can define specific recordings to export to your Endpoints and trigger the export automatically, as needed.

The below details how secrets (API keys, credentials, certificates and so on) are securely handled and stored, and briefly covers how data is protected with strict access control and monitoring, and discusses how various security measures are in place to aid in data loss protection.

Secret management is centralized and automated, reducing the risk of human error and exposure. All secrets (for example API keys, credentials, and certificates) are stored in a secure, encrypted vault (AWS secrets Manager) and only programmatic access to the keys is available from the microservices. Humans do not get access to the database directly (including Uniphore employees). Access to these secrets is governed by strict policies, and no developers or unauthorized personnel can directly access or view these secrets. This approach mitigates the risk of credential compromise and ensures that sensitive information is always handled securely.

Uniphore’s platform employs rigorous data handling policies and monitoring mechanisms to ensure that data access is always restricted to authorized services. This includes continuous monitoring for anomalies and potential security threats, with alerts and automated responses designed to mitigate any detected risks. As a result, Uniphore customers can trust that their sensitive data is not only isolated from other tenants but also shielded from unauthorized access and exposure at all times. For more information see Authentication and Authorization, as well as Monitoring and Incident Response.

As mentioned previously, access to Uniphore’s cloud operations in the Production environment is tightly controlled and monitored. All access is routed through Teleport, a security platform that provides secure access to hosts, services, and infrastructure components. Teleport enforces stringent authentication and authorization policies, providing granular access controls and session recording capabilities. This means that all actions performed within the production environment are audited in real-time, ensuring full traceability and accountability for every operation. Furthermore, access is limited to only authorized personnel, minimizing the attack surface and preventing any unauthorized interactions with critical infrastructure.

Uniphore’s IT infrastructure also utilizes numerous controls to ensure and limit access to network and resources only by authorized users.  All endpoints are secured with Antivirus, Endpoint Detection and Response solutions, and Data Loss Prevention applications.  Access to IT administrative tools is restricted to authorized personnel from IT.

For more information on Uniphore's general corporate security practices, security procedures, assessments, certifications and compliance practices, see Additional Security Information.

Access to the platform is governed through JWT (JSON Web Token) access tokens, which are used end-to-end across all platform services. These tokens are issued by a trusted identity provider, Okta Auth0, and include critical information such as unique identifiers, user details, roles, and permissions. This data is used to enforce strict access control.

The JWT tokens are validated and inspected centrally by the API Gateway ingress controller, which is implemented using Kong. The gateway serves as a critical enforcement point, verifying the authenticity and integrity of each token before granting access to any platform service. This ensures that only authorized requests, which carry the correct claims, can access the appropriate data and resources.

Data is irrecoverably purged on an hourly basis from Uniphore core services.  All data purged by the Uniphore servicevtriggers underlying AWS delete mechanisms that securely destroy the encrypted data from persistent volumes.

Uniphore ensures that customer data never leaves the secure boundaries of the designated cluster, which is configured to comply with industry-leading security standards at rest and in transit: