Is UiPath safe with your data?

Customer controls training data

For cloud products the customer is the data controller and UiPath the processor. Training is tied to the customer contract for product improvement, and the policy tells users not to put personal or sensitive data into Trial, Community or test versions.

Named sub-processors and transfer safeguards

The sharing section lists specific service providers such as Salesforce, Atlassian, Microsoft 365, AWS and Stripe under contractual agreements. International transfers rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, and EU-U.S. and Swiss-U.S. Data Privacy Framework certification.

No selling or ad-sharing

The policy states it does not sell or share mobile or personal data, and that mobile data will under no circumstances be shared or sold for advertising or promotional use. California residents can opt out of sharing via dpo@uipath.com.

Retention and security stay vague

Most retention is described as a limited period as necessary, with only a few named windows such as Customer Advisory Board data at 18 months, candidate data up to a year, and interview recordings up to 3 months. The security section names no specific controls like TLS or AES, and no breach-notification timeframe is given.