Canadian data residency
Production services and customer data are hosted in Canada.
Confirm Canadian data hosting and review any external provider data flows during procurement.Security & trust
Union data security and access controls
UnionStack brings tenant scope, identity, permissions, private file handling and secure integration patterns together so teams can connect their work without treating access as an afterthought.
Account access in practice
Review account access and sign-in security.
The connected account centre shows verified email, organization access and current two-factor status. Account settings and recent activity are available through separate controls.
Connected account interface shown. Two-factor authentication is off in this capture; account controls are lower on the page.
Identity and browser sessions
Use password or passwordless sign-in, configured external providers, multi-factor authentication and recovery. Staff sessions permit two concurrent browsers on an estimated shared device, with explicit confirmation for a different-device takeover or replacement of the oldest third session.
A layered model
Security follows the record from request to storage.
A trustworthy union platform needs more than a secure sign-in. The organization context, the user’s authority, the requested record, any stored object and every integration path all participate in the decision.
Tenant-scoped persistence
Reads are filtered to the active tenant and writes reject records that do not match tenant context.
Tenant context is part of the persistence boundary, not only a user-interface filter.Permission-respecting access
Application and API operations remain subject to the authenticated user, tenant, roles and applicable record rules.
Connected records do not remove the distinct permissions around sensitive work.Private object storage
Tenant-specific containers disable public access and validate object paths before storage operations.
Private documents are served through authorized application paths rather than public containers.Application-layer encryption
Governed object content is protected with tenant-keyed authenticated AES-GCM envelopes before it is written to blob storage.
Key management and operating procedures remain part of the production deployment review.Modern API authorization
Developer integrations use OAuth 2.0 authorization code flow with PKCE and tenant-aware access.
An API client does not become a path around application authorization.Procurement review
Turn assurance into answerable questions.
Use these prompts to keep an evaluation specific to the environment, providers and workflows your union expects to operate.
Data location
Which data remains in Canada, and which enabled providers process data elsewhere?
Tenant boundary
How is organization context applied to reads, writes, files and background work?
Authorization
Which roles, scopes and record rules protect the workflow being evaluated?
Encryption
Where are transport, platform and application-layer protections applied?
Public and member access
How are public publishing and authenticated member experiences kept distinct?
Contractual assurance
Which requirements need current documentation or an executed agreement?
Shared responsibility
Configuration and operating practice matter.
Technology supplies boundaries. Administrators still decide who receives access, what is published and when those decisions need to be reviewed.
- 01
Design roles
Model responsibilities before assigning broad access.
- 02
Review access
Test with representative accounts and revisit access as duties change.
- 03
Protect secrets
Keep credentials, provider keys and recovery paths out of shared records.
- 04
Control publishing
Verify public and member visibility before promoting content.
- 05
Reassess
Repeat the review when workflows, integrations or providers change.
Buyer questions
Direct answers, with their limits.
Confirm environment-specific controls and contractual requirements during procurement.
Where is customer data hosted?
UnionStack production services and customer data are hosted in Canada. Enabled external providers should be reviewed separately.
How are stored documents protected?
Tenant-specific object containers disable public access, validate paths and can apply tenant-keyed authenticated encryption before storage.
Does an API bypass application permissions?
No. API requests operate with tenant and user context and remain subject to the applicable authorization rules.
Does connected data mean every user can see everything?
No. Relationships can remain connected while module, role and record-level rules restrict who may access sensitive information.
How are integration secrets handled?
Secrets belong in protected server-side configuration and key-management boundaries, never in public content or browser bundles.
Are public sites and member experiences the same boundary?
No. Public publishing and authenticated member access are distinct choices and should be tested independently.
Does UnionStack claim a certification here?
No certification is claimed without separate current evidence. Request documentation for any contractual, regulatory or assurance requirement.
Before you choose
Practical answers for your evaluation.
What should an IT or procurement reviewer request?
Bring your access, retention, recovery, export and provider requirements to the evaluation. Ask which controls are implemented, which need tenant configuration and which evidence can be supplied for your review. A public feature description is not a security certification or a contractual service level.
How should data portability be evaluated?
Test the supported exports for the records your union needs, including scope, permissions, relationships and attachments where applicable. Agree retention, extraction and transition responsibilities before purchase. Do not assume a table export reproduces an entire application or its configuration.
Next step
Bring your security requirements into the evaluation.
Try a real workflow with the 30-day trial, or request a guided walkthrough with UnionStack.
Credit card required. Automatic billing after 30 days.