Is this your company?Buyers are checking OneRail here. Claim onerail.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Leveraging our massive driver network, actionable data and the ability to change delivery outcomes, OneRail gives supply chain professionals the competitive advantage to seamlessly fulfill from store, same-day or warehouse, across all legacy systems. Here, you can find relevant, real-time security control information and documentation. You can access documents like our SOC II attestations and Penetration Tests. Please note that some document access may request you to agree to a Non Disclosure Agreement.
OneRail is proud to announce that we have achieved ISO/IEC 27001:2022 certification, the leading international standard for information security management. This certification demonstrates that OneRail’s Information Security Management System (ISMS) has been independently audited and verified to meet rigorous global standards for managing security, risk, and compliance. Combined with our SOC 2 Type II reports and other controls, ISO/IEC 27001:2022 reinforces our commitment to protecting customer data, ensuring operational resilience, and maintaining trust.
This listing is partial
7/11 details · 64%
SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is OneRail SOC 2 compliant?
OneRail is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is OneRail ISO 27001 certified?
According to OneRail's public trust center, OneRail is ISO 27001 certified. On SOC2C this listing is Listed.
Is OneRail GDPR compliant?
According to OneRail's public trust center, OneRail is GDPR compliant. On SOC2C this listing is Listed.
Is OneRail HIPAA compliant?
According to OneRail's public trust center, OneRail is HIPAA compliant. On SOC2C this listing is Listed.
Is OneRail CCPA compliant?
According to OneRail's public trust center, OneRail is CCPA compliant. On SOC2C this listing is Listed.
Is OneRail SOC 2 Type I or Type II?
OneRail is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use OneRail's SOC 2 for a vendor risk assessment?
Yes. OneRail's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is OneRail penetration tested?
OneRail hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is OneRail secure?
Security isn't a single yes/no, but OneRail is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, HIPAA, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does OneRail have a bug bounty or vulnerability disclosure program?
OneRail hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@onerail.com or via a /security page (OneRail lists a security contact).
Who are OneRail's subprocessors?
OneRail lists 6 subprocessors on its trust center, including Microsoft Azure, GitHub, Slack, Datadog, Salesforce. Buyers use this for fourth-party risk review.
Where does OneRail host or store data?
OneRail hosts on Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is OneRail's trust center or security page?
OneRail's trust center is at https://trust.onerail.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Which independent audits and certifications has OneRail completed?
OneRail undergoes annual SOC 2 Type II audits covering all five Trust Service Criteria and achieved ISO/IEC 27001:2022 certification. We also align with HIPAA, GDPR, and other privacy regulations. Audit reports and certifications can be shared under NDA via our Trust Center.
How does OneRail handle vulnerability management and incident response?
We run continuous vulnerability scanning (cloud, endpoints, applications) and track remediation against defined SLAs. We have a documented Incident Response Plan with 24/7 monitoring and escalation. Any event impacting security or privacy triggers immediate triage, investigation, containment, and customer notification as required by law or contract.
What controls are in place to protect production environments and customer data?
Production systems run in segregated environments with enforced RBAC, PIM/JIT access, encryption at rest and in transit, network segmentation, and continuous logging/monitoring. No developer or contractor has standing privileged access; all elevated access is time-bound, logged, and reviewed.
How does OneRail ensure compliance with privacy regulations (GDPR, HIPAA, CCPA)?
We operate as a data processor and only process personal data under customer instruction. Data Subject Requests (DSRs) are handled through defined procedures. PHI/PII is encrypted, access is strictly limited, and retention follows the data minimization principle. We maintain a GDPR Compliance Policy and HIPAA safeguards covering privacy, security, and breach notification.
How are third-party vendors and subcontractors vetted and monitored?
All vendors go through Third-Party Risk Management reviews, including security due diligence, contractual data protection clauses, and ongoing monitoring. Vendors with access to sensitive systems/data must meet our minimum security standards, and we audit compliance regularly.
How does OneRail secure integrations (APIs, TMS, ERP, WMS, etc.)?
Integrations use secure APIs with authentication, authorization, and encryption. All connections are logged, rate-limited, and monitored for abuse. Keys and secrets are managed in line with NIST standards, and no sensitive data is transmitted without encryption in transit (TLS 1.2+).
Will OneRail share internal security policies or procedures with customers?
No — we do not share internal policy documents for security reasons. However, our controls are independently validated through annual SOC 2 Type II audits, ISO/IEC 27001 certification, and penetration testing. Summaries of these reports and certifications are available via our Trust Center under NDA.
Does OneRail conduct penetration tests, and can results be shared?
Yes — we conduct annual penetration tests with independent third-party firms. While we do not share full reports (to prevent exploitation of findings), we provide executive summaries and remediation evidence upon request under NDA.
How does OneRail handle data residency and cross-border data transfers?
By default, our services are hosted in Microsoft Azure data centers in the United States, with redundancy across U.S. regions. For Canadian and EU/UK customers, data may currently be processed in U.S. regions. In these cases, we rely on recognized transfer mechanisms such as the EU Standard Contractual Clauses (SCCs), UK IDTA/Addendum, and PIPEDA safeguards to ensure compliance with GDPR, UK GDPR, and Canadian privacy law. Because Microsoft Azure operates multiple regions worldwide — including Canada Central/East, EU regions, and the UK — OneRail can scope region-specific deployments where contractual or regulatory requirements demand in-region storage and processing.
