Skip to content
OncryptOncrypt
Sign inBook a demo

Prove your security before a client asks.

Oncrypt finds the gaps, fixes them with you and keeps your proof ready for every questionnaire.

Northside ClinicExample data
MFA off for 3 adminsDMARC not enforced
  • Our in house pentest team runs the tests.
  • Our own engines do the scanning.
  • Independent auditors issue the stamp.
  • Read only access to your systems.

Most compliance is paperwork. Attackers still walk through the open doors.

A badge proves you filled in a form. It does not prove the login page is safe.

A badge can hide an open door.

Each gap below passes a checklist and fails a real attacker.

  • The badge proves nothing.

    A checklist passed in March says nothing about the login page you shipped in May.

  • Five vendors that never talk.

    Your scanner, device tool, policy tool and pentest firm each report alone. Nobody connects the dots, so the risk falls between them.

  • Nobody to face the auditor.

    The auditor asks hard questions on a call you join alone.

  • A bill that grows at every renewal.

    Each new tool adds a line item. The renewal always costs more.

What hides behind a compliant badgeExample data

Connect once. Oncrypt does the rest.

Link the accounts you already use. Oncrypt reads them and never changes them.

Example data. Four read only connections for Northside Clinic. Google Workspace, Microsoft 365 and AWS are live. GitHub waits for approval.
Connected accountsExample data

Example data. Connected accounts for Northside Clinic, read only. Google Workspace, connected; Microsoft 365, connected; AWS, connected; GitHub, pending.

Connected accounts

3 of 4 connected, read only

  • Google WorkspaceEmail and documentsConnected
  • Microsoft 365Identity and devicesConnected
  • AWSCloud accountsConnected
  • GitHubCode repositoriesPending
Example data. Five open findings for Northside Clinic. Two are critical, two are high and one is medium.
FindingsExample data

Example data. A table of 5 open findings for Northside Clinic. 2 are critical: MFA off for 3 admins and API key found in repo history. 2 are high: Patient intake page loads Meta Pixel and Laptop disk encryption off. One is medium: DMARC not enforced.

Findings

5 open

  • MFA off for 3 adminsAccounts and accessCriticalOpen
  • Patient intake page loads Meta PixelWebsite and trackersHighOpen
  • API key found in repo historyCodeCriticalOpen
  • DMARC not enforcedEmail and domainMediumOpen
  • Laptop disk encryption offDevicesHighReview
Example data. A finding about MFA for 3 admins moves from Open to Fixed to Verified by our team. The score rises from 86 to 91.
Fix flowExample data

Example data. A finding for Northside Clinic: MFA off for 3 admins, in accounts and access, owned by Northside IT. It moves through three stages: Open, Nov 3, 09:14, found by oncrypt scan; Fixed, Nov 5, 16:40, fixed by northside it; Verified by our team, Nov 6, 10:05, verified by oncrypt team. It is now verified by our team. The score rises from 86 to 91 when the fix is verified.

MFA off for 3 admins

Accounts and access. Owner Northside IT

Verified by our team

Stages

  1. Open Nov 3, 09:14. Found by Oncrypt scan, completed
  2. Fixed Nov 5, 16:40. Fixed by Northside IT, completed
  3. Verified by our team Nov 6, 10:05. Verified by Oncrypt team

Oncrypt score

86
Before fix
91
After verification

Fix steps

  • 1Turn on MFA for each admin account
  • 2Remove legacy admin accounts
  • 3Confirm with a sign in test
Example data. A trust page for Northside Clinic with the 100% Oncrypted badge, four live controls and three documents available on request.
Trust pageExample data

Example data. A trust center for Northside Clinic, with the 100% Oncrypted badge and the status "Verified by our team". Live controls: MFA enforced for all staff, passing; Disk encryption on for 42 devices, passing; Backups tested this quarter, passing; Patient portal logs reviewed, review. Documents, each available on request: Penetration test summary, 2026; SOC 2 readiness report; Data processing agreement; Subprocessor list.

Trust center

Northside Clinic

Verified by our team
100% Oncrypted

Live controls

  • MFA enforced for all staffPassing
  • Disk encryption on for 42 devicesPassing
  • Backups tested this quarterPassing
  • Patient portal logs reviewedReview

Documents behind the request

  • Penetration test summary, 2026
  • SOC 2 readiness report
  • Data processing agreement
  • Subprocessor list

Five vendors or one team. Pick the one that answers the auditor.

Software alone leaves the gaps with you. Consultants bill for each project. Oncrypt runs the work end to end.

  • Who fixes the gaps

    Oncrypt
    Our team, with you
    Software only tools
    You do the work
    Consultants
    A separate project

  • Who runs penetration tests

    Oncrypt
    Our in house team
    Software only tools
    Not included
    Consultants
    A new project each time

  • Whose scanning engines

    Oncrypt
    Our own
    Software only tools
    Third party tools
    Consultants
    Varies by firm

  • Vendors you manage

    Oncrypt
    1
    Software only tools
    Several
    Consultants
    Several

  • Who answers the auditor

    Oncrypt
    Our compliance lead, ready in advance
    Software only tools
    You, alone
    Consultants
    The consultant, when you hire one

  • Monitoring between audits

    Oncrypt
    Continuous
    Software only tools
    Continuous
    Consultants
    Rare

Every module feeds one score and one evidence trail.

Each module reports into the same score. What it finds lands in the same evidence trail your auditor reads.

86

Score

Both groups feed this score. Each fix you close raises it.

One number for your whole setup, with the fixes that raise it most.

Security

  • Continuous monitoringWatches accounts, devices and domains and flags each change.
  • Code scanningFinds leaked keys and insecure code before you ship.
  • Cloud checksReviews cloud accounts for public storage and weak access.
  • Website and tracker scanningFinds tracking pixels, weak headers and open forms on your site.
  • Device checksChecks laptops and phones for encryption and screen locks.
  • Penetration testsOur testers attack your systems and show how to close each gap.

Compliance

  • PoliciesReady templates you adapt, with a record of each approval.
  • People and trainingAssigns security training and tracks who still needs it.
  • VendorsLists each vendor, its data and the proof it has given you.
  • Risk registerRecords each risk with an owner, a severity and a plan.
  • Evidence vaultKeeps every screenshot, export and document an auditor asks for.
  • Trust centerShares your live controls and documents with clients on request.
  • Auditor accessGives your auditor read only access to evidence, never to systems.
  • AI questionnairesDrafts security questionnaire answers from your evidence for review.

Attackers never wait for the annual audit.

Our in house testers attack your site and systems the way a criminal would. Then they retest every fix before the finding closes.

  • Oncrypt employs every tester.
  • Every report gets a second check before you see it.
  • Each finding comes with the exact fix and a retest.
Northside ClinicExample data

One fix moves four frameworks at once.

Most frameworks ask for the same controls, so each verified fix counts toward every one of them.

Example data. The fix Turn on MFA for all admins lifts readiness for HIPAA from 71 to 79, SOC 2 from 68 to 76, ISO 27001 from 64 to 70 and GDPR from 73 to 78. The scene also shows PCI DSS, UAE PDPL and Saudi PDPL, which do not change.
One fix, four frameworksExample data
One fix
Turn on MFA for all adminsAccounts and access
Readiness after this fix
  • HIPAA+8 from this fix
  • SOC 2+8 from this fix
  • ISO 27001+6 from this fix
  • GDPR+5 from this fix
Choose a framework

HIPAA

79 of 100 ready. This fix adds 8 points.

What one set of controls covers

One admin MFA policy answers the access checks that HIPAA asks for.

See HIPAA readiness

SOC 2

76 of 100 ready. This fix adds 8 points.

What one set of controls covers

One admin MFA policy answers the access checks that SOC 2 asks for.

See SOC 2 readiness

ISO 27001

70 of 100 ready. This fix adds 6 points.

What one set of controls covers

One admin MFA policy answers the access controls that ISO 27001 asks for.

See ISO 27001 readiness

GDPR

78 of 100 ready. This fix adds 5 points.

What one set of controls covers

One admin MFA policy supports the access security that GDPR asks for.

See GDPR readiness

PCI DSS

58 of 100 ready. This fix does not change this score yet.

What one set of controls covers

Its card data controls need their own evidence, so this fix does not count here yet.

See PCI DSS readiness

UAE PDPL

66 of 100 ready. This fix does not change this score yet.

What one set of controls covers

Its personal data controls need their own evidence, so this fix does not count here yet.

See UAE PDPL readiness

Saudi PDPL

61 of 100 ready. This fix does not change this score yet.

What one set of controls covers

Its personal data controls need their own evidence, so this fix does not count here yet.

See Saudi PDPL readiness

Your industry holds the data attackers want.

Each sector has its own weak spot. We check for the one that matches yours.

Risks we check first

  • Tracking pixels on patient pages can send health details to advertisers.
  • Intake and booking forms often send details to scripts nobody reviewed.
  • Patient portals and email need the same checks as the public site.
See healthcare checks

Risks we check first

  • One admin password stands between an attacker and every client document.
  • A client portal without a second step lets one stolen password open an account.
  • Login pages with no attempt limit let attackers guess passwords at speed.
See finance checks

Risks we check first

  • A public link to a case file outlives the matter it was made for.
  • Shared folders often keep access for people who no longer work on the matter.
  • Client documents sent by link are easy to forward and hard to recall.
See legal checks

Risks we check first

  • Listing and enquiry forms pass buyer details to scripts nobody approved.
  • A third party script on a property page can read what a visitor types.
  • Enquiry forms with no checks invite spam and malicious links.
See real estate checks
Northside ClinicExample data
Halden Finance PartnersExample data
Marrow & Dell LegalExample data
Oakmere Property GroupExample data

Show clients the proof, not the promise.

When your score reaches 100% Oncrypted, your trust page shows live controls and the documents behind them. Your clients can share the same proof with their own clients.

100% Oncrypted
Full size

100% Oncrypted means every applicable control passes and our team has verified it.

How clients use it

  • On their site footer

    Clients place the badge in their own website footer, so every visitor sees it.

  • In proposals

    The badge goes on proposals, so buyers see the proof before the first call.

  • In security questionnaires

    The answer links to the trust page, so the reviewer checks live controls, not a promise.

Footer size
Northside ClinicPrivacyTrust page
100% Oncrypted
Example data. A trust center for Northside Clinic with the 100% Oncrypted badge, four live controls (three passing, one in review) and documents behind a request button.
Example data

Example data. A trust center for Northside Clinic, with the 100% Oncrypted badge and the status "Verified by our team". Live controls: MFA enforced for all staff, passing; Disk encryption on for 42 devices, passing; Backups tested this quarter, passing; Patient portal logs reviewed, review. Documents, each available on request: Penetration test summary, 2026; SOC 2 readiness report; Data processing agreement; Subprocessor list.

Trust center

Northside Clinic

Verified by our team
100% Oncrypted

Live controls

  • MFA enforced for all staffPassing
  • Disk encryption on for 42 devicesPassing
  • Backups tested this quarterPassing
  • Patient portal logs reviewedReview

Documents behind the request

  • Penetration test summary, 2026
  • SOC 2 readiness report
  • Data processing agreement
  • Subprocessor list

Your bill matches your size and stays flat.

Your scope sets your fee. We confirm the figure with you before you commit to anything.

See plans
Example data. A scope panel with three principles and three scope items. Second site sits in your plan. We quote the extra framework and the additional pentest before they start.
Your scopeExample data

  • Your fee follows the size of your business.

    Small teams and large firms pay for the scope they need, no more.

  • Predictable from the first invoice.

    The fee covers the platform, the scans and the team's work in your plan. We quote extra work before it starts.

  • Every change shows before it bills.

    Adding a site or a framework shows the new fee before anything changes.

Scope items

  • Second site
    Included
  • Extra framework
    We quote first
  • Additional pentest
    We quote first

Brandsquare

From the team behind 575+ projects for 325+ clients

Brandsquare builds the systems these businesses run on, so we know where they break.

Straight answers before you book a call.

The questions buyers ask first.

Talk to us

100% Oncrypted

Find the gap before your next client does.

Scan your domain now or book a call with our team.

Book a demo