Every UiPath product is designed and developed with security in mind.
Security is built directly into our development lifecycle, by performing both automated security scans and red team style penetration tests on every build.
We submit our releases to independent third-party review by Veracode at the highest level to ensure that our security is more than trusted, it is certified.
UiPath maintains an ISO 27001:2013 certification for all of our core platform products and cloud services. Our ISO 27001 certification shows that UiPath has adopted a framework of policies and procedures that includes all legal, physical and technical controls involved in an organization's information risk management processes. Our ISO 27001 Certification can be found here.
UiPath recognizes the importance of implementing appropriate technical and organizational security measures in order to prevent any unauthorized access, disclosure, alteration or destruction of such data. For this purpose, UiPath implements industry standard security controls and maintains a comprehensive security program.
UiPath has a risk management process in place based on which it designs the set of security controls meant to reduce security risks to an acceptable level. A Risk Assessment is conducted at least annually and identified risks are mitigated according to risk severity and business priorities and captured in a Risk Treatment Plan.
Users are only granted access to business resources that they have been specifically authorized to use in accordance with defined access control policies and processes. The access rights of all users to information are granted as appropriate for conducting their duties and removed upon resignation or termination of employment, contract or agreement, or adjusted upon a change in role.
Access to all systems is protected by two factor authentication and a strong password policy. Users' access to business applications is controlled and logged. UiPath has logging enabled for log-on activities on systems and generates alerts for unusual log-on behavior.
Owners of critical business systems and applications have the responsibility to grant, review and remove users’ access, as defined in UiPath’s Access Control Policy and giving consideration to the concepts of least privilege and segregation of duties.
UiPath employs a strong Password Policy, along with multi-factor authentication and single sign-on on all enterprise applications and systems. Users have the responsibility to maintain the confidentiality of their passwords, as described in the Password Policy.
Within UiPath, information assets are protected throughout the information life cycle, including entry into UiPath’s systems, secure data transmission, and appropriate data access, storage, retention and disposal.
UiPath requires all its employees, contractors and third parties to respect a set of security measures when handling UiPath devices and information, as defined in the Acceptable Technology Use Policy.
All UiPath assets holding Confidential Data have an identified Asset Owner and are kept in an inventory that covers the entire lifecycle from purchase to disposal. Return of all equipment and secure disposal of data upon contract termination with employees or contractors is ensured.
All UiPath information assets are appropriately classified in terms of value, legal and contractual requirements to enable employees to handle them appropriately.
UiPath had defined and communicated to its employees the requirements for acceptable use of UiPath's resources in order mitigate the risk of unauthorized access to UiPath equipment, as well as use and modification of information assets. These include clear desk and clear screen rules, data handling requirements, password maintenance, equipment security and breach reporting / incident notification.
UiPath has controls in place to mitigate the risk of improper and unsecure disposal and destruction of data, technology equipment and components owned by UiPath, including shredding hardcopy records which contain internal and confidential information, overwriting or physically destroying removable media, erasing or destroying mobile devices and securely erasing storage space allocated by cloud services, according to the cloud provider’s methodology.
Our Acceptable Use Policy restricts the storage of Customer Data locally, on the user’s device or on removable media.
For more information on the deletion of customer data, please refer to our Privacy controls.
Devices which access to Confidential Information are adequately protected, according to UiPath’s Managed Devices Policy. UiPath will, in limited circumstances, allow users to utilize their personal devices to access UiPath business resources. Users’ responsibilities and access to mobile devices containing non-public corporate information are restricted and controlled according to the BYOD Policy.
UiPath devices have security measures enforced on them and they are monitored for compliance deviations. Software installations on all UiPath systems is controlled by our operational security policy, which restricts and tightly controls installation of unwanted software.
Teleworking is part of our culture and we do our best to make sure it is done securely. Teleworkers who access any UiPath Business information from remote locations are required to comply with the Teleworking Policy.
UiPath ensures that employees agree to terms and conditions concerning confidentiality and information security appropriate to the nature and extent of access they will have to the organization’s assets and that go beyond the duration of the employment contract.
Upon termination of a work relationship, all access to information environments is removed and company assets are retrieved.
Responsibilities regarding information security are communicated to UiPath employees and they are informed that disciplinary actions can be taken against them based on violations of policies and procedures. We make sure all UiPath employees receive awareness trainings regarding UiPath policies as well as security risks and the protection of sensitive data.
UiPath takes preventive measures prior to employment in the form of Background Checks, as prescribed by our Background Checks Policy.
Only industry-standard algorithms for encryption and key strength approved by UiPath Engineering and IT departments are used to encrypt UiPath data and assets used in production or business use cases. At minimum, Uipath encryption is used to protect UiPath and customer or third-party non-public data in transit across public environments.
Additionally, encryption is used to protect UiPath and customer or other third-party data over which UiPath has custodianship at rest. UiPath uses known Certificate Authorities for the issuance of public key certificates. Keys have defined activation and deactivation dates so they can only be used for a limited period of time and they are protected from modification, loss, destruction and unauthorized disclosure during their use, storage, and handling (lifecycle). Keys are replicated/ duplicated as necessary to execute necessary backup and disaster recovery activities.
The use of cryptography is monitored to ensure compliance with applicable regulations.
UiPath maintains a Third-party Vendor Risk Management Program through which it assesses and manages the risks assumed by the nature of relationships with vendors and contractors that receive, store, process or host UiPath data or have access to UiPath network and systems.
UiPath concludes data protection agreements and imposes security requirements on its vendors in order to ensure that at least the same level of confidentiality and data security is implemented by its sub-contractors as the ones applicable to UiPath.
The list of security requirements required from our vendors is available here.
UiPath maintains the right to perform audits in order to monitor the compliance of its sub-contractors with the agreed technical and organizational measures regarding data confidentiality and security.
Physical security measures are designed to prevent unauthorized physical access or damage caused by physical and environmental threats to UiPath's employees, premises, system and network devices and information, as well as interruptions to the organization's activities. The level of security measures, policies and procedures implemented are commensurate with the risks and particular legal, regulatory or contractual requirements associated with each facility.
Access to premises is monitored through access controls, such as individual badges and through video surveillance. Asset movement controls are in place and the buildings are protected for seismic, flood and other similar risks. Data availability and continuity of service is ensured by using top cloud service providers.
Uipath has a strong process in place to provide a rapid and effective response to security incidents, in order to minimize risks while ensuring the availability of information systems.
In order to respond to incidents effectively and timely, UiPath Incident Management teams are ready to take necessary actions to contain the threat, eradicate the source of the incident and restore the affected systems, information and data.
Incident responders track the incident root causes, the lessons learned in the incident management system and propose continuous improvements to system and data owners.
Based on the material nature of a major incident, the UiPath legal team will initiate contact with affected parties outside of UiPath in accordance with regulatory and contractual obligations.
UiPath utilizes a decentralized office approach to leverage cloud-based services. Users are not dependent on specific office locations to perform their duties. Data processing environments maintain redundancy to meet availability requirements. Systems are built with failovers within availability zones.
UiPath informs all employees and contractors regarding their obligations around information security. We provide annual training to our employees to help improve the company’s cyber hygiene and protect UiPath assets.
UiPath conducts periodic reviews of security policies and practices through independent third-party auditing services, as well as internal assessments as deemed appropriate. The policies are reviewed and updated regularly to ensure that they comply with changes to the law, adopted standards, organizational policies, contractual obligations and that they are appropriate to the risks faced by the company.
Intrusion prevention and detection systems and firewalls are in place to protect our network.
Separation of test, development and operational facilities is ensured.
Appropriate anti-malware protection is maintained.
Regular backups of essential business information are maintained through Microsoft Azure for UiPath online services. An appropriate backup cycle is used and documented.
Event logs recording user activities, exceptions, faults and information security events are produced, kept and regularly reviewed.
Information about technical vulnerabilities of information systems being used is obtained in a timely fashion and the organization’s exposure to such vulnerabilities is evaluated and appropriate measures are taken to address the associated risk.
UiPath defines information security related roles and responsibilities across the organization: Executive management (CIO, CPO, CTO, CLO); Employees and contingent staff. The information security functions, roles and responsibilities are organized and defined by the Product Trust Management Board (PTMB), which establishes and ensures the security governance within the organization.
Our security, availability, and confidentiality commitments for our Cloud Platform include, but are not limited to, the following:
When using UiPath Cloud Platform, your data will benefit from multiple layers of security and governance technologies, operational practices, and compliance policies that UiPath enforces.
Service-design principles
All of the services packaged together as UiPath Cloud Platform are delivered via a Software-as-a-Service (SaaS) model that’s built and hosted in Microsoft Azure. They all use core Azure services, including compute, storage, networking, SQL database, app configuration, secret storage in Key Vault, and identity and access management. This allows us to focus on the unique aspects of running UiPath’s services while taking advantage of, and building upon, Azure’s state-of-the-art capabilities in security, privacy, and compliance. We also utilize the industry certifications available through Azure. At UiPath, we share the responsibility of protecting your data with Azure and strictly adhere to the guidance they publish.
Data encryption
We encrypt all customer data at rest in any data store that is part of our service. For example, we use transparent data encryption in SQL databases. All data is transmitted over protected channels, whether it travels over the Internet or within our internal service components.
Identity and access management
We support account creation in our Cloud Platform using a variety of identity service providers, such as Google, Microsoft, and LinkedIn, as well as through native accounts. Post account creation, our services manage a given user’s access rights using application-managed, role-based access control checks. Our on-premises customers have long used Orchestrator’s roles-based account control (RBAC). With the introduction of Tenant Management in our Cloud Platform, we now have similar RBAC controls for our Cloud Platform to provide a seamless experience for our customers.
Tenant data isolation
Data from each tenant is logically separated from others in our service so that we can enforce access and authorization controls for all tenants as they access data inside our service.
Package integrity
Starting with the 2019 fast-track release of our core platform, we added the ability to sign packages and workflows that are uploaded into Orchestrator. As an aside, Cloud Platform customers automatically receive the latest updates, meaning our Cloud Platform customers also get this new, additional protection. Customers can publish packages to UiPath-managed Cloud Platform Orchestrator with confidence and not worry about package integrity and corresponding business impact in the event that a server-side compromise occurred.
Privacy
UiPath collects two categories of data from users to operate and improve UiPath Cloud Platform Services:
1. Customer data: Includes user-identifiable transactional and interactional data that we need to operate the service and to manage your contract with UiPath
2. System-generated logs: Includes service-usage data that may be aggregated and contain pieces of customer data.
From a GDPR standpoint, UiPath is considered a data processor. As such, we honor all obligations of a data processor by providing customers with full control over their data, in accordance with the product architecture and implementation. We have ensured that we can export all of your data for you upon request. Should you close your account with UiPath Cloud Platform, or otherwise request data deletion, we delete that data from our systems after the requisite 30-day soft-delete period. We recommend our customers assess if their use of our Cloud Platform is in line with their privacy obligations. For more information about UiPath’s privacy statement, how UiPath processes your data when using online services, and GDPR commitments, please visit our Privacy Policy.
Data residency and sovereignty
We know our customers care deeply about data location. As of late-2019, we now support two separate server regions, US and EU (Ireland). Resources associated with unpaid user accounts are stored in EU. The location of services for paid users is based on the location of the user. We will serve all content, and store all data, for the user in the region that matches the paid user’s location and sovereignty requirements. We may continue to add additional regions as we see our customer base grow.
Security and compliance practices
UiPath addresses the following aspects of security and compliance in order to help prevent breaches and uphold the highest standards for data security, privacy, and availability:
Systems hardening
UiPath Cloud Services use Azure's Platform-as-a-Service (PaaS) offering for much of its infrastructure. PaaS automatically provides regular updates for known security vulnerabilities.
Secure development life cycle
UiPath security and development teams work hand in hand to address security threats throughout the development process of UiPath Cloud Platform. Teams perform threat modeling during service design. They adhere to design and code best practices and verify security in the final product using a multi-pronged approach that leverages internally built tools, commercial static and dynamic analysis tools, internal penetration testing, and external bug bounty programs. We also monitor vulnerabilities introduced in our code base through third-party libraries and minimize our dependency on these libraries and corresponding exposure. Because the security landscape is continually changing, our teams stay current with the latest in best practices. We also enforce annual training requirements for all engineers and operations personnel working on UiPath Cloud Platform.
Service and data availability
Ensuring that UiPath’s Cloud Platform services are available so you can access your organization’s assets is of the utmost importance to us. That is why we rely on Azure’s backup mechanism and practice data recovery. We employ other fail-safes to help ensure availability. A malicious distributed denial-ofservice (DDoS) attack, for example, could affect UiPath Cloud Platform service availability. Azure has a DDoS defense system that helps prevent attacks against our service. It uses standard detection and mitigation techniques such as SYN cookies, rate limiting, and connection limits. The system is designed not only to withstand attacks from the outside, but also from within Azure.
Live site testing
We emulate adversarial tactics on our services and underlying infrastructure using internal red teams. The goal is to identify real-world vulnerabilities, configuration errors, and other security gaps in a controlled manner so that we can test the effectiveness of our prevention, detection, and response capabilities.
Security incident response
We strive to minimize the attack surface of our services and go to great lengths to reduce the probability of a data breach ever occurring. Nevertheless, security incidents can still happen. In the event of a breach, we use security response plans to minimize data leakage, loss, or corruption. We provide transparency to our customers throughout the incident. Our 24x7 SRE and Security team is always on hand to rapidly identify the issue and engage the necessary development team resources to contain the impact of the incident. Once the team has contained an issue, our security incident management process continues as we identify the root cause and track the necessary changes to ensure we prevent similar issues in the future.
Production access control
We maintain strict control over who has access to our production environment and customer data. Access is only granted at the level of least privilege required and only after proper justifications are provided and verified. If a team member needs access to resolve an urgent issue or deploy a configuration change, they must apply for "just in time" access to the production service. Access is revoked as soon as the situation is resolved. Access requests and approvals are tracked. If the username and password for one of our developers or operation staff were ever stolen, data is still protected because we use two-factor authentication for all production system access.
Secrets Management
Secrets that we use to manage and maintain the service, such as encryption keys, are managed, stored, and transmitted securely through the Azure Management Portal. All secrets are rotated on a regular cadence and can be rotated on-demand in the case of a security event.
UiPath platform on premises components are always installed in the customer environment. Based on past experiences with our customers we can make the following security recommendations:
Monitoring and Logging
The UiPath suite has configurable logging capabilities, so it can log anything in a database and text files. It can be integrated with Nlog, or the Windows Events Log, Elastic Search Log, Server Log. Each step of the automation can be monitored and logged locally or in a central database. Logs are time-stamped files which contain informational events, error and warning messages relevant to the application. The logging process is subject to a high degree of customization at both Robot and Orchestrator level. The UiPath suite already has pre-built setting which you can use to have a standard logging model, but it also gives you the opportunity of creating customized logs based on your company requirements. If settings are left at the default level, a log entry will be generated every time a process is started, stopped, or encounters an error. At the highest configuration level of verbose, every single action that is performed by the robot is logged.
Web Services Security
All the web services are TLS Enabled (for TLS 1.2+). The communication can be over HTTP or HTTPS with any of the Web Services and with the Web Application. The exact ciphers and TLS version allowed are configured by the customer by changing the SCHANNEL settings of Windows Server where Orchestrator is installed. The Customer should provide the SSL certificate. The certificate can either be a Domain certificate (generated in IIS for that specific domain, and that can be used only in that domain) or can be a web security certificate generated by a Certification Authority (like VeriSign).
Encryption
All credential data stored in Orchestrator is encrypted. We use a FIPS compliant AES 256 algorithm for encrypting data at rest. HTTPS is the default for all data in transit. The exact TLS versions, ciphers, and certificate strength are all configurable. All versions of SSL/TLS and ciphers are supported by Orchestrator and robots.
Segregation of Duties
The Segregation of duties has been considered at the Orchestrator level. Orchestrator comes with two roles predefined: administrator and robot. The administrator role has full access to all components whereas the robot role is used for all robots. Any number of additional roles can be created to suit an organization’s needs. Create, read, update, and delete (CRUD) permissions can be defined for each component within Orchestrator. Multitenancy enables you to isolate data, with only one instance of Orchestrator. This feature facilitates automating different departments from your company and ensures the desired authorization of Orchestrator data per department. Any objects created in one tenant are not accessible from another including users, robots, processes, etc. However, please note that all the data is stored in the same database.
Since 2018, UiPath has been part of the Veracode Continuous Verified certification program. This is an ongoing certification that UiPath must adhere to at all times with bi-annual audits to verify UiPath’s commitment to security.
Veracode Verified Continuous is the highest level of the Verified program from Veracode, Leader in the Gartner Magic Quadrant for Application Security and builds on the security processes embedded in the development lifecycle of our products. This certification validates key aspects of our security strategy including:
As of October 2020, UiPath’s Veracode certification is broken down into three platform areas: UiPath Platform, UiPath Cloud Platform, and UiPath Automation Hub. Each of these platforms includes many different products, all of which go through the same certification process, but for easier management have been included in platforms. As this may not be intuitive, please see the table below to understand what product is included with each platform
*Orchestrator and Orchestrator as a Service are the same source code repository. Because of this Orchestrator is certified one time under the UiPath Platform.
You can check out our certification status on the Veracode website here.
UiPath's Bug Bounty Program (“Program”) aims to leverage the expertise of HackerOne's ethical hacker community to find vulnerabilities in our RPA Platform and surrounding ecosystem in order to keep our customers, partners and community users safe from malicious activities.
The Program focuses on high priority items such as:
Before every GA/Major release for our products, we run:
Issues found go through a triage process and through a remediation process, as necessary.
