Decide who sees each record, person or bot.
Every piece of data carries a record type. You give each person, bot, and API client read, write, and update rights per type, and they see exactly what you meant them to.
SOC 2 and HIPAA, with one audit trail and an isolated database for every account.
100+ countries · Cloud, hybrid, or onsite · 1 to 1,000 seats
- PolicyWritten in the visual designer or as raw JSON.
- Record typeCarried by each piece of data, on standard and custom objects.
- AgentRead, write, and update rights on the record types granted.
- BotRights from a permission set, the way a user gets them.
- Audit trailSign-ins, record changes, workflow runs, and calls, logged.
Write a policy point and click, or paste it as JSON. One engine runs both.
Your cloud team already knows the format. Bundle rights into permission sets, hand them to users and groups, and keep each one as wide or as narrow as the role needs.
OAuth 2.0 tokens, tied to a policy every time.
People and integrations sign in over OAuth 2.0 and get a JWT that's renewed for them. Each token carries a policy, so an integration can't reach past what you gave it.
Bots don't get special access. Most teams scope a bot tighter than the agent working beside it. How we put bots to work
- People
Sign in once and carry one policy everywhere.
- API clients
Your integrations answer to policies, just like your staff.
- Bots
A bot is a user with a policy. Nothing about it is special.
Read, write, and update rights on each record type.
Rights start at the object and narrow down to the record type, on your standard objects and every custom object you build.
Before
- Access to an object opens every record in it.
- Seeing a record and changing it come as one right.
- Custom objects get whatever rules were left over.
On Unbound
- Read per record type, so people see the types they're granted and nothing outside them.
- Write per record type, set apart from read.
- Update per record type, with every change logged.
The answers your questionnaire is looking for.
- Encrypted.
Calls, messages, records, and files, in transit and at rest.
- Logged.
Sign-ins, record changes, workflow runs, and calls, by people, bots, and API clients. Ask us about SIEM export and retention.
- Isolated.
Every account runs on its own database, built from a clean template.
- SOC 2 and HIPAA.
We'll share the SOC 2 report and its period under NDA, and walk you through how HIPAA controls apply to your data.
What reviewers ask us first.
Can one user see every record in an object?
No. You set read, write, and update per record type, so opening an object never means opening everything in it.
How are API clients authenticated?
Over OAuth 2.0. Each integration gets a JWT tied to the policy you gave it, and it's renewed automatically.
What can an AI agent see and do?
Whatever its permission set and record types allow, nothing more. Every MCP call it makes is logged in the trail your team's API calls go to.
Is Unbound SOC 2 and HIPAA?
Yes, with encryption in transit and at rest and an isolated database for every account. Ask for the SOC 2 report and its period under NDA. For SSO and SAML, MFA, data residency, retention, subprocessors including AI model providers, and the uptime commitment, ask us in the review; we answer each in writing.
Thirty days. Bring your questionnaire.
Send us your questionnaire and we'll walk permission sets, record types, and the audit log with your security team.