FAQ

Common questions about UnitOne Compliance: SOC 2 and EU CRA programmes, Article 14 reporting, runtime evidence from agents in your network, and how to start.

What is UnitOne?

UnitOne Compliance runs SOC 2 and EU CRA programmes and collects runtime evidence from agents in your network. Security Remediation turns findings into reviewable PRs.

How is this different from a cost dashboard?

Cost dashboards show model spend. UnitOne Compliance collects runtime evidence from agents in your network, including what was blocked, and you can attribute spend from that same path.

Does runtime evidence stay in our network?

Yes. Runtime evidence for agents comes from a gateway you deploy in your AWS, Azure, or GCP network, outbound HTTPS only. Agent traffic stays in your environment.

How does multi-cloud deploy work?

The data plane runs in your AWS VPC, Azure VNet, or GCP project. Prompts, virtual keys, and spend stay with you. The UnitOne control plane holds tenant config, policy, inventory, and evidence. Sync uses outbound HTTPS only: admin API, identity federation, and webhooks. See how UnitOne Compliance collects runtime evidence.

Is remediation included when I start free?

No. Finding → Fix Spec → PR work is a scoped proof of concept, not the self-serve product. Request a remediation POC if you need that engagement.

How do we get started?

Start free on UnitOne Compliance. Article 14 reporting is free on every plan. Talk to us for more than 2 products. Use Request a remediation POC when you need intent-preserving fixes that land as reviewable PRs.

What is EU CRA Article 14 for security teams?

Article 14 is the manufacturer reporting clock for actively exploited vulnerabilities and severe incidents. An SBOM is inventory, not that report. See CRA Article 14: The 24 / 72 / Final Reporting Clocks for the operational evidence list.

How do you attribute spend to agents, not seats?

Agents are AI workloads; seats are console users. Discovery, experiments, and published agents need separate identities and caps. See Agent discovery to publishing spend.

What counts as a product?

One SOC 2 system or one EU CRA product. Free covers 1, Team covers 2. More than 2, talk to us.

Is Article 14 reporting really free?

Yes. Preparing the 24 hour early warning, the 72 hour notification and the final report is free on every plan.

What is the difference between Article 14 and vulnerability handling?

Article 14 is the reporting duty for actively exploited vulnerabilities and severe incidents. Vulnerability handling is the ongoing process in Annex I Part II: receiving reports, fixing, and disclosing. UnitOne Compliance keeps evidence for both.