What your security, legal and procurement teams usually ask about Unicorn Academy for Business, answered in one page.
The service runs on Cloudflare (Workers and D1 database). Data is stored by Cloudflare and processed in its network. Payment data is handled only by Stripe and never reaches our systems.
The service works with pseudonymous user identifiers that you supply; names are optional. For your end users we act as processor under the data processing agreement: we do not use their data for our own purposes, do not sell it and do not use it for advertising. IP addresses are not stored in the database.
All traffic, the embedded script and webhooks use HTTPS with TLS 1.2 or higher. Data at rest is encrypted by the storage provider. Secret API keys are stored only as hashes and shown once; test and live keys are separate.
Dashboard access with single-use email links and sessions of 30 days in Secure and HttpOnly cookies, no passwords. Every record is bound to your account and every query is filtered by account; test data is kept apart from live data. Signed links carry an HMAC signature and an expiry time.
Every attempt is recorded with date, questions, answers, score, test version and language in a tamper evident hash chain. Exports in CSV and JSON can be checked against the chain.
You choose how long test records are kept, from 30 to 3650 days (5 years by default); they are deleted automatically at the end. After the end of the contract you can export your data for 30 days; it is then deleted within 30 days, except records the law requires us to keep.
Results are delivered by webhook signed with HMAC SHA-256 and a timestamp, so you can check the origin and reject replays. Webhook endpoints must use HTTPS.
There is no contractual SLA. The state of the API, the test pages, the course catalog and billing is checked every 5 minutes and shown on the status page.
Unicorn Private LLC does not hold its own certifications such as SOC 2 or ISO 27001. Our infrastructure providers publish their own certifications on their websites.
We give at least 30 days' notice before adding or replacing a sub-processor, as set out in the data processing agreement.
A standard security questionnaire, already filled in, is available to download. Your team can use it directly in its vendor assessment.
The terms of service and the data processing agreement, with the standard contractual clauses, are accepted online when you subscribe. There is no separate contract to sign.
Terms of Service · Data Processing Agreement · Privacy · Status · API docs
Unicorn Academy for Business is a knowledge assessment tool that you use inside your own onboarding and appropriateness processes. You decide how to use the results; the responsibility for any appropriateness or suitability assessment stays with you as the regulated firm. The service does not by itself ensure compliance with MiFID or any other regulation.