UiPath
uipath.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- No clear commitment that your data will not train their models
- Data retention window not stated
- Certification claim not corroborated: AIUC-1
See Before you sign, with what to ask for ↓
Scanned Aug 28, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance — governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The public sources scanned do not clearly state that customer prompts, files, and outputs are excluded from training or fine-tuning of first- or third-party models.
What to ask for: Get a no-training clause covering first- and third-party models into the DPA/order form.
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
Why it matters: aiuc-1.com was checked on 2026-08-20 and no record was found for this vendor. Not every certification body publishes to the registry, so this is not proof the claim is false — but a certification claimed this prominently should be verifiable. No public attestation registry exists on aiuc-1.com; UiPath appears there as 'Founding Technical Contributor to AIUC-1', which is standards involvement, not certification. The claim is not disproven, but both of UiPath's AI certification claims are now un-corroborated in public registries after active search (20 Aug 2026). Ask the vendor for the attestation report and issuer.
What to ask for: Require the certificate number, issuing body, scope statement and validity dates in writing before signing. A vendor that cannot produce them has answered the question.
Buyer questionsanswered only from the public evidence scanned — click a row for the answer
!Will they train on your data?Ask the vendor
Not found in the public sources scanned — ask the vendor directly.
!How long do they keep your data?Ask the vendor
Not found in the public sources scanned — ask the vendor directly.
✓Who else can access your data?Clear
UiPath IXP (Intelligent Xtraction and Processing) is available on Google Cloud Marketplace with Gemini as the default model.
“UiPath Intelligent Xtraction and Processing (IXP) is now available on Google Cloud Marketplace with Gemini as the default model.”
“https://www.uipath.com/assets/downloads/subprocessors-deprecated 1 UiPath Sub-processors UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations. Below is a list of vendors”
“UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations.”
!Where is your data processed?Ask the vendor
Automation Cloud on Microsoft Azure is available in South Korea specifically to support local data residency for regulated industries.
Confirm in writing: Ask the vendor to state this in writing before signing.
“UiPath Automation Cloud on Microsoft Azure is now available in South Korea, supporting local data residency for regulated industries.”
!What happens in a security incident?Ask the vendor
UiPath publishes a security contact and a HackerOne-hosted vulnerability disclosure policy via security.txt.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Policy: https://hackerone.com/uipath”
Key findingsclick a row for the evidence
✓AI-specific certifications claimed: ISO/IEC 42001 and AIUC-1Strong
UiPath repeatedly and specifically claims independent certification to ISO/IEC 42001 for its AI governance system and AIUC-1 for agent behaviour under adversarial testing — among the most concrete AI-specific assurance claims a vendor can make today.
AI-management-system certification directly answers the governance question most vendors leave open; the claims are specific enough to verify against certification registries.
Question for vendor: Which certification body issued the ISO/IEC 42001 and AIUC-1 certificates, and what products and legal entities are in scope?
“Independently certified to ISO 42001 and AIUC-1. Audit logs, access controls, and human-in-the-loop apply to every agent.”
“Governance is independently verified: ISO 42001 for the AI governance system, AIUC-1 for agent behavior under adversarial testing.”
!Model supply chain is configurable, defaults only partially namedGap
The platform's model layer is deliberately flexible — third-party and UiPath models, external coding agents — with Gemini named as a default only for IXP on Google Cloud. Which providers process customer data in a given deployment depends on configuration.
A buyer cannot enumerate the model providers in their request path from public material alone; the answer varies by product and configuration.
Question for vendor: For each product in our proposed deployment, which model providers are in the default request path, and where is that documented?
“Connect a diverse set of third-party and UiPath models.”
“UiPath Intelligent Xtraction and Processing (IXP) is now available on Google Cloud Marketplace with Gemini as the default model.”
“Direct third-party coding agents like Claude Code, Codex, and Cursor to build, troubleshoot, test, and deploy agents across both paths via UiPath for Coding Agents.”
✓Human-in-the-loop and evaluation controls described as defaultsStrong
Evals before and after deployment, full audit traces, and human routing of exceptions are described as applying to every agent by default rather than as optional add-ons.
Default-on oversight controls materially reduce the buyer-side configuration burden for agentic deployments.
“Identity, access controls, audit logs, AI governance, and PII filtering apply to every agent by default.”
“Evals score outcomes before and after deploy, traces and audit logs make every step inspectable, and Action Center routes exceptions to a human reviewer rather than letting them fail silently.”
!No training-data statement found in fetched pagesGap
None of the fetched pages state whether customer data is used to train or fine-tune UiPath's own models or is retained by third-party model providers.
The training-data question is the one buyers ask first of an AI platform, and the fetched public pages do not answer it.
Question for vendor: Is customer data used to train or fine-tune any UiPath or third-party models, and what are the retention terms with model providers?
“Connect a diverse set of third-party and UiPath models.”
?Stripe observed but not named in public materialsObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a undefined, which the vendor's public trust materials do not name.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Stripe appears to be involved as a undefined — can you confirm and disclose this relationship?
“Connect a diverse set of third-party and UiPath models.”
“UiPath Intelligent Xtraction and Processing (IXP) is now available on Google Cloud Marketplace with Gemini as the default model.”
?Technical dependency observed: StripeObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Connect a diverse set of third-party and UiPath models.”
“UiPath Intelligent Xtraction and Processing (IXP) is now available on Google Cloud Marketplace with Gemini as the default model.”
“customer Cloud Software Customer Selected OpenAI, LLC Providing generative AI services, such as Large Language Models. Cloud Software Customer Selected Google LLC Hosting and providing virtual infrastructure and generative AI services including Large Language Models Looker services:”
“https://www.uipath.com/assets/downloads/subprocessors-deprecated 1 UiPath Sub-processors UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations. Below is a list of vendors”
“UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations.”
?Technical dependency observed: AtlassianObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Connect a diverse set of third-party and UiPath models.”
“UiPath Intelligent Xtraction and Processing (IXP) is now available on Google Cloud Marketplace with Gemini as the default model.”
“customer Cloud Software Customer Selected OpenAI, LLC Providing generative AI services, such as Large Language Models. Cloud Software Customer Selected Google LLC Hosting and providing virtual infrastructure and generative AI services including Large Language Models Looker services:”
“https://www.uipath.com/assets/downloads/subprocessors-deprecated 1 UiPath Sub-processors UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations. Below is a list of vendors”
“UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations.”
Assurance dimensionsweighted components of one score — not eight separate ratings
Organisation & AI governance15% of the score75
Who owns AI risk — policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Control logic may include explicit rules, constraints, and policies that shape behavior and provide predictable, auditable decision paths.”
“Identity, access controls, audit logs, AI governance, and PII filtering apply to every agent by default.”
“Our technology includes an evolving set of safeguards, controls, and human-centered guardrails to ensure responsible AI and automation.”
Governance & accountability: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI system10% of the score40
What AI the vendor actually runs and where it sits in the product — the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Agents run inside the platform that already orchestrates robots, APIs, and people. They inherit the execution, governance, and operational controls proven at scale,”
“Control logic may include explicit rules, constraints, and policies that shape behavior and provide predictable, auditable decision paths.”
“Direct third-party coding agents like Claude Code, Codex, and Cursor to build, troubleshoot, test, and deploy agents across both paths via UiPath for Coding Agents.”
How AI features are evaluated before and after release — evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“Implement robust security measures, such as encryption, access controls, and regular vulnerability assessments to protect sensitive information and maintain the integrity of agentic AI systems.”
“Evals score outcomes before and after deploy, traces and audit logs make every step inspectable, and Action Center routes exceptions to a human reviewer rather than letting them fail silently.”
How changes to models and AI features are controlled and communicated — versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
AI system description: vendor-evidenced, not yet independently corroborated.
Testing & evaluation: vendor-evidenced, not yet independently corroborated.
Change management: not publicly evidenced.
Model10% of the score75
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“customer Cloud Software Customer Selected OpenAI, LLC Providing generative AI services, such as Large Language Models. Cloud Software Customer Selected Google LLC Hosting and providing virtual infrastructure and generative AI services including Large Language Models Looker services:”
“https://www.uipath.com/assets/downloads/subprocessors-deprecated 1 UiPath Sub-processors UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations. Below is a list of vendors”
“Connect a diverse set of third-party and UiPath models.”
“UiPath Intelligent Xtraction and Processing (IXP) is now available on Google Cloud Marketplace with Gemini as the default model.”
Agent10% of the score35
No independently corroborated agent-specific assurance (AIUC-class or equivalent).
Customer data15% of the score52
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“UiPath Automation Cloud on Microsoft Azure is now available in South Korea, supporting local data residency for regulated industries.”
AI supply chain10% of the score75
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“customer Cloud Software Customer Selected OpenAI, LLC Providing generative AI services, such as Large Language Models. Cloud Software Customer Selected Google LLC Hosting and providing virtual infrastructure and generative AI services including Large Language Models Looker services:”
“https://www.uipath.com/assets/downloads/subprocessors-deprecated 1 UiPath Sub-processors UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations. Below is a list of vendors”
“UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations.”
Security foundation10% of the score64
How security problems are found, reported and handled — disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Policy: https://hackerone.com/uipath”
Independent assurance evidence10% of the score71
Whether claimed certifications and attestations are independently corroborated — checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Independently certified to ISO 42001 and AIUC-1. Audit logs, access controls, and human-in-the-loop apply to every agent.”
“Governance is independently verified: ISO 42001 for the AI governance system, AIUC-1 for agent behavior under adversarial testing.”
Read from the registry record above — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Independent assurance: vendor-evidenced, not yet independently corroborated.
Legal & contractual10% of the score40
The contractual backbone a buyer can rely on — terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“UiPath uses sub-processors to provide its products and to perform the relevant business operations. Sub-processors go through a vendor assessment and are subject to proportionate confidentiality and security obligations.”
What would strengthen assuranceeach figure is from today's score — resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 59 → up to 80 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split — that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 5 — registry checks and verification ladders, click to view
Claimed as independent certification of the AI governance system; issuer, certificate and scope not stated in fetched pages.
Checked against Schellman Certificate Directory, Aug 28, 2026: Verified on the registry
Claimed for agent behaviour under adversarial testing; issuer and scope not stated in fetched pages.
Checked against aiuc-1.com, Aug 20, 2026: Not found on the registry (not every certification body publishes there — ask the vendor for the certificate)
Checked against Data Privacy Framework (dataprivacyframework.gov), Aug 28, 2026: Verified on the registry
Checked against CSA STAR Registry, Aug 28, 2026: Verified on the registry
Checked against FedRAMP Marketplace (fedramp.gov), Aug 28, 2026: Verified on the registry
Sources 17 — click to view
Appendix: standards landscape 8 — click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses UiPath at an organisational level. Assurance can vary significantly between products, models and agents — enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.