Trust Centre
Security, privacy, and data sovereignty for the Unicorn platform and your 5K rollouts. Here is how we protect your data, and why it always remains yours.
Transparency & sovereignty
A secure platform built for transparency and sovereignty. Ultimately, your customer data is your data, never ours.
Defending your data
We defend your data against threats and fraudulent activity using the same infrastructure and security services we run our own operations on.
Independently verified
We undergo rigorous, independent verification of our security, privacy, and compliance controls to help you meet your regulatory objectives.
ISO/IEC 27001:2022 Certification
Howatson+Co and Plus Also Studios hold ISO/IEC 27001:2022 certification (Certificate No. 2026-12600), the international standard for information security management. Our certification is independently audited by Sustainable Certification, an AIMS-accredited body.
You can verify our certification on the JAS-ANZ register.
Data residency
We store your data in the region that matches your customers, supporting your data sovereignty requirements.
- Australia & New Zealand: data is stored and processed in the Oceania region
- European Union: data is stored in an EU region
- Everywhere else: data is held on the Cloudflare global network, at the location closest to your users
Your data & AI models
The Unicorn platform is powered by enterprise agreements with upstream AI providers. Your data is used only to produce your output. It is never used to train AI models, and it always remains yours, not Plus Also Studios’.
Plugins & processing
How your data is processed depends on the tool you use:
- InDesign & Figma rollout plugins: process your data directly on your device (client-side)
- Unicorn platform: processing happens securely server-side, and the data used for a rollout is removed once the rollout is complete. Outputs you choose to save remain available while your subscription is active so you can re-download them
What we collect
We keep data collection lean and purposeful:
- Product analytics (via PostHog): to understand how features are used so we can improve the platform
- Login & identity (via Kinde): to sign you in securely and manage access
- Diagnostic telemetry: to monitor reliability and resolve issues quickly
Enterprise controls & governance
For teams with stricter requirements, Unicorn provides enterprise-grade controls:
- Single sign-on (SSO): sign in with your own identity provider over SAML/OIDC, such as Okta, Azure AD, or Google Workspace, with roles and workspaces mapped to your team automatically
- Usage limits & cost controls: set limits on platform and AI usage, with alerts before you reach them, so spend stays predictable
- Audit & accountability: a 12-month, append-only record of account activity (who did what, and when). Audit-event export to your own systems or SIEM is available on request under enterprise agreements
Secure development & our team
Security is built into how we work, not added as an afterthought.
- Trained team: our staff are trained in security and privacy best practice
- Secure development methodology: we follow a secure development methodology, with changes peer-reviewed before they ship
- Encryption: your data is encrypted in transit and at rest
Data deletion & retention
We keep your data only for as long as we need it.
- 5K rollouts: the files and project data you submit for a 5K rollout are permanently deleted on completion of the job
- Unicorn platform: data used for a rollout is removed once the rollout is complete, and outputs you choose to save remain available while your subscription is active
Privacy policy
For full details on how we collect, use and protect your personal information, please see our privacy policy.
FAQs
Questions?
If you have any questions about our data practices, security, or compliance, or you would like documentation for a vendor review, please get in touch.