Security & Trust
Our Commitment to Secure Practices
Your data stays in your infrastructure. It never leaves it, and nobody but you has access to it. Our controls are independently audited in a SOC 2 Type 2 engagement.
SOC 2 Type 2
On-premises deployment
No vendor-hosted data
Encrypted in transit and at rest
SOC 2 Type 2 attestation
A Type 2 report goes beyond control design. An independent auditor tested whether our controls operated effectively over a full 12-month period, across governance, risk management, logical access, system operations, change management and vendor management (Common Criteria CC1–CC9).
Report
SOC 2 Type 2
Criteria
Security (Common Criteria)
Period
Apr 1, 2025 – Mar 31, 2026
Auditor
Sensiba LLP
Also available
SOC 3 (public)
Compliance reports
View our SOC reports to learn more about the controls and practices behind Connect to AD.
SOC 3 Report 2026
Read the general-use report summarizing our security controls and assessment.
SOC 3
View report
SOC 2 Type 2 Report 2026
Review the assessment of our controls and their operating effectiveness.
SOC 2 Type 2
View report
Your data stays in your infrastructure
Connect to AD is a Windows service installed on a server in your network. It reads employee records from UKG over its REST API and writes changes to Active Directory and Microsoft Entra ID. There is no Connect to AD cloud in the data path.
All connections are initiated by the Connect to AD service from inside your network: HTTPS on TCP 443 to UKG and Microsoft Graph, LDAP on 389 or LDAPS on 636 to your domain controllers.
On-premises by design
Deployed and operated in your infrastructure, under your security policies, patching and monitoring.
Outbound connections only
The service initiates every connection to explicitly configured endpoints. No inbound ports need to be opened.
No vendor-hosted data
The Connect to AD team does not host, replicate or have standing access to your employee or directory data.
Stateless processing
Each run reads the current state from UKG and your directory, applies your rules and exits.
Data protection
Encrypted wherever data moves or rests
Encryption and data minimization at every step.
Encrypted in transit
All UKG and Microsoft Graph traffic uses HTTPS with TLS on port 443, with server certificate validation.
Secure directory binding
Connections to Active Directory support LDAPS on port 636 for encrypted directory reads and writes.
Credentials encrypted at rest
API credentials and directory bindings are are encrypted and stored in the local configuration database (RFC 2898), never in plain text.
Data minimization
Only the attributes you map are read and written. Accounts not linked to UKG are never modified.
Access control
Least privilege, under your control
The service runs with the permissions you grant it, and nothing more.
Dedicated service accounts
Separate accounts for UKG, Active Directory and Entra ID, scoped to the data and OUs you manage. No Domain Admin required.
No standing vendor access
The Connect to AD team has no persistent access to your environment. Support sessions are initiated by you, time-bound and supervised.
Secure development
Controlled releases, deployed on your schedule
Every release follows a documented path from code to your server.
Version-controlled code
Every source change is tracked and approved.
Tested and scanned
Changes pass QA and regression testing, and vulnerability scanning runs continuously.
Approved, versioned releases
Releases are approved by authorized personnel and published with release notes.
Upgrades on your terms
You choose when to upgrade, validate in a test environment first and can roll back.
Auditability
Every change is traceable
Each change can be traced back to the UKG record and the rule behind it.
Before-and-after logs
Each run logs attribute values before and after every change, plus the rule evaluations.
Alerts on errors and events
Email notifications for sync errors, new accounts, terminations and name changes.
Preview before you commit
Preview mode and a separate test environment show the exact changes before production.
Resilience
Built to fail safely
Errors stay contained and recover on the next cycle.
Idempotent runs
Running the same sync twice produces the same result. No duplicates, no drift.
Failures stay isolated
An error on one record does not stop the run. It is retried on the next cycle.
Safe by default
Duplicate employee IDs are flagged and skipped, never guessed.
Simple recovery
Restore the service and its configuration from your standard server backups.
Resources
Everything your security team needs
Review our controls and policies, download our compliance reports, or read the technical details in our Help Center.
FAQ