OneRail

OneRail is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. OneRail's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

OneRail hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but OneRail is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, HIPAA, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

OneRail hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@onerail.com or via a /security page (OneRail lists a security contact).

OneRail lists 6 subprocessors on its trust center, including Microsoft Azure, GitHub, Slack, Datadog, Salesforce. Buyers use this for fourth-party risk review.

OneRail hosts on Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

OneRail's trust center is at https://trust.onerail.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Integrations use secure APIs with authentication, authorization, and encryption. All connections are logged, rate-limited, and monitored for abuse. Keys and secrets are managed in line with NIST standards, and no sensitive data is transmitted without encryption in transit (TLS 1.2+).

No — we do not share internal policy documents for security reasons. However, our controls are independently validated through annual SOC 2 Type II audits, ISO/IEC 27001 certification, and penetration testing. Summaries of these reports and certifications are available via our Trust Center under NDA.

Yes — we conduct annual penetration tests with independent third-party firms. While we do not share full reports (to prevent exploitation of findings), we provide executive summaries and remediation evidence upon request under NDA.

By default, our services are hosted in Microsoft Azure data centers in the United States, with redundancy across U.S. regions. For Canadian and EU/UK customers, data may currently be processed in U.S. regions. In these cases, we rely on recognized transfer mechanisms such as the EU Standard Contractual Clauses (SCCs), UK IDTA/Addendum, and PIPEDA safeguards to ensure compliance with GDPR, UK GDPR, and Canadian privacy law. Because Microsoft Azure operates multiple regions worldwide — including Canada Central/East, EU regions, and the UK — OneRail can scope region-specific deployments where contractual or regulatory requirements demand in-region storage and processing.