Is this your company? Buyers are checking Onetrace Ltd here. Claim onetrace.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Onetrace Ltd
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Onetrace Ltd is SOC 2 compliant. Onetrace Ltd also holds ISO 27001, and GDPR.
About
A powerful cloud-based application that has been developed from the ground up, Onetrace supports subcontractors across the construction industry, by providing one system to capture, monitor, review and report on all work being conducted in real time.
Compliance & infrastructure
Hosting
AWSGCP
Subprocessors
23- AAmazon Web Services · Cloud providerUnited Kingdom
- MMongoDB · Data storage and processingUnited States
- SSentry · Cloud monitoringUnited States
- SStripe · Finance and paymentsUnited Kingdom
- AAircall · Customer supportUnited Kingdom
- AAmazon Web Services (Intercom) · Cloud infrastructure and hostingUnited States
- AAnthropic · Large Language Model (LLM)United States
- CCalendly · CollaborationUnited States
- CClay · Sales & MarketingUnited States
- CClerk · Identity providerUnited States
- GGoogle LLC · CloudUnited States
- GGong · SalesUnited States
Show all 23 subprocessorsShow fewer
- HHotjar · AnalyticsIreland
- IIntercom · Customer supportUnited States
- JJuro · Contract lifecycle managementUnited Kingdom
- LLoom · Screen recordingUnited States
- MMailerLite · Email marketingGermany, Netherlands
- MMailerSend · Transactional email serviceGermany, Belgium
- NN8N · Workflow automationGermany
- OOpenAI · EngineeringUnited States
- PPlanhat · Customer successUnited Kingdom
- PPowerSync · Backup SyncEurope
- SSlack · CollaborationUnited States
Compliance leadership
The person who leads Onetrace Ltd's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Onetrace Ltd's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Onetrace Ltd SOC 2 compliant?
Onetrace Ltd is SOC 2 compliant. On SOC2C this listing is Listed.
Is Onetrace Ltd ISO 27001 certified?
According to Onetrace Ltd's public trust center, Onetrace Ltd is ISO 27001 certified. On SOC2C this listing is Listed.
Is Onetrace Ltd GDPR compliant?
According to Onetrace Ltd's public trust center, Onetrace Ltd is GDPR compliant. On SOC2C this listing is Listed.
Can I use Onetrace Ltd's SOC 2 for a vendor risk assessment?
Yes. Onetrace Ltd's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Onetrace Ltd penetration tested?
Onetrace Ltd hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Onetrace Ltd secure?
Security isn't a single yes/no, but Onetrace Ltd is SOC 2 compliant and holds ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Onetrace Ltd have a bug bounty or vulnerability disclosure program?
Onetrace Ltd hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@onetrace.com or via a /security page (Onetrace Ltd lists a security contact).
Who are Onetrace Ltd's subprocessors?
Onetrace Ltd lists 23 subprocessors on its trust center, including Amazon Web Services, MongoDB, Sentry, Stripe, Aircall. Buyers use this for fourth-party risk review.
Where does Onetrace Ltd host or store data?
Onetrace Ltd hosts on AWS, GCP. Data residency details are on its trust center.
Where is Onetrace Ltd's trust center or security page?
Onetrace Ltd's trust center is at https://trust.onetrace.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Where will the system's data be hosted?
Core platform data (projects, jobs, materials etc.) is hosted in AWS UK (London, eu-west-2). Support chat data processed via Intercom's AI agent is stored in the US (AWS US-East, Northern Virginia), covered by Intercom's DPA and SCCs.
Will all data be hosted and processed within the UK or EU?
Not entirely. Core operational data is UK-hosted (AWS London). Support chat data via Intercom is processed in the US, with SCCs in place to cover that transfer.
Which data centres are backups stored in?
Both primary data and backups are hosted in AWS London (eu-west-2).
If the system went down or was hacked, where are documents stored and how could they be accessed?
Data and documents are stored in cloud infrastructure with automated backups and versioning. In the event of a compromise, systems would be isolated, access secured, and the most recent clean backup restored. Infrastructure access is controlled via RBAC and MFA.
Is all data encrypted at rest?
Yes, all data is encrypted at rest using AES-256, including all MongoDB Atlas backups.
Is all data in transit encrypted?
Yes, using TLS 1.2 or higher for all data transmitted over public networks.
Does the vendor have a documented vulnerability management and patching process?
Yes. Continuous automated scanning runs on every pull request and dependency update. Issues are tracked, prioritised by risk, and remediated via a formal change management process. AWS handles underlying infrastructure patching; application workloads are updated via rebuilt images and CI/CD deployments.
Are detailed audit logs maintained for all user and administrator activity?
Yes — particularly for admin and privileged users. All administrative access and privileged logins are logged. While the documentation doesn't explicitly use the term "tamper-proof," logs are protected via strict RBAC, and automated alerting/behavioural monitoring would flag any attempt to alter them.
Does the system include role-based access control (RBAC)?
Yes. RBAC is the primary access control method, governed by a least-privilege principle. Access to production systems is limited to authorised internal staff and reviewed regularly.
Is MFA enabled for all logins?
Not by default for standard users, but it is available. MFA is strictly enforced for all administrators and privileged access to production infrastructure.
Does the vendor provide secure backup and disaster recovery solutions?
Yes. MongoDB Atlas Continuous Backups provide daily full snapshots plus continuous incremental backups with Point-in-Time Recovery (PITR). Backups are encrypted at rest and in transit, stored in infrastructure logically and physically separated from primary clusters. AWS infrastructure includes automated scaling, high-availability failover, and multi-AZ redundancy.
Do we have an ISO Certificate
Yes, a copy of the ISO 27001 certificate is on the Onetrace Trust Centre. The Trust Centre also includes subprocessors, resources, controls, and the NHS DSPT certificate.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public