Secure from the infrastructure up.

Where is UnityTrip hosted?

UnityTrip runs on Microsoft Azure, whose infrastructure is independently audited.

Built on Microsoft Azure

UnityTrip is a member of the Microsoft AI Cloud Partner Program (ISV Success) and is available on the Microsoft Azure Marketplace.

UnityTrip inherits Azure's assurance for data centres, network and platform services. The application, its configuration and its data handling are UnityTrip's own responsibility and are not covered by Azure's reports. Where an organisation requires UnityTrip's own audit documentation, please get in touch.

How does UnityTrip protect customer data?

• Encryption — data is encrypted in transit.
• Role-based access control (RBAC) — users and operations staff access only what they are authorised to.
• Zero-trust architecture — every request is authenticated and authorised, with no implicit trust between components.
• Infrastructure as code — every environment is reproducible and every configuration change is auditable.
• Event-sourced audit trail — every booking, change, and approval is recorded as an immutable event, giving a complete, tamper-evident history.
• Credential management for staff, contractors and dependants follows their changing roles and travel privileges.

Is UnityTrip suitable for security-conscious or regulated enterprises?

Yes. UnityTrip runs in production for organisations with demanding compliance and operational requirements, including in regulated sectors such as energy and resources.

How is customer data isolated between tenants?

Each client is an isolated tenant, provisioned through infrastructure as code, so your data never shares a boundary with another organisation's and a deployment can be aligned to its data-residency requirements.

Can UnityTrip detect a rogue identity inside a trusted network?

Yes. A rogue automation inside a customer's trusted network, a misconfigured script or a misbehaving AI agent, can push a platform many times past its normal load. Perimeter security alone can only block all the customer's traffic or stay open and go down. UnityTrip's per-identity observability isolates the offending identity in real time, down to the individual account, so it is stopped without blocking the customer, while autoscale headroom absorbs the surge. The API face of this — the security manifest, per-identity activities, and role endpoints — is documented in the API reference.

How does UnityTrip stay available during demand surges?

Disruption is when a travel platform matters most — and when load spikes hardest. UnityTrip is event-sourced and distributed: work is queued and streamed rather than contended in a single database, so the platform is designed to absorb surges of 10 to 1,000 times normal activity and degrade gracefully. State is replayable from the event stream, and a public status page for the website is published at platformstatus.unitytrip.com.

Does UnityTrip use AI to make booking decisions on customer data?

No. UnityTrip's doctrine is frontier AI at build time, determinism at run time: AI helps design and configure each client's policy; the engine that decides bookings is deterministic and auditable, and the same booking gets the same answer every time, with the rule that decided it attached. An AI assistant that answers traveller questions is grounded in the client's own policy documents and is never the judge. The model hangs off the change feed and is never in the booking path, so a model outage delays an automation and never blocks a transaction.