Trust center
We run Oncrypt on Oncrypt.
We are 100% Oncrypted. Our team verifies every applicable control on our own systems. This page explains how we protect those systems and your data. It marks anything we are still confirming.
001 Our security posture
Our own systems pass the same checks we sell.
Every applicable control on our systems passes. Our team verifies the result. Our compliance lead owns the evidence. An independent audit firm issues the final audit stamp. [Placeholder: audit status and date, to confirm.]
Verified by our team
Audit ready
Status page
002 Data handling
We keep client data to what the score needs.
Each type of data has a stated purpose, a retention period and a deletion path. [Placeholder: confirm the data inventory before launch.]
What we collect
How long we keep it
How you delete it
Where it is hosted
003 Read only access
Read only access to your systems.
Our connectors read settings and report what they find. They ask only for the read permissions their checks need. [Placeholder: list the permission scopes for each connector, to confirm.]
004 Encryption
Encryption in transit and at rest.
Client data is encrypted in transit and at rest. [Placeholder: confirm this statement and the details below before launch.]
In transit
At rest
Key management
005 Subprocessors
Every third party that processes client data.
We name each subprocessor, what it does and where it runs. [Placeholder: subprocessor list with name, purpose and location, to confirm.] [Placeholder: notice period for new subprocessors, to confirm.]
Security contact
Report a security issue.
Found a security issue or have a question about our controls? Read our security policy and contact our team.