Onfleet

Onfleet hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Onfleet's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Onfleet is SOC 2 Type II compliant and holds SOC 2 Type II, CCPA, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Onfleet hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@onfleet.com or via a /security page (Onfleet lists a security contact).

Onfleet lists 9 subprocessors on its trust center, including Amazon Web Services, Auth0, MongoDB, Datadog, Google Workspace. Buyers use this for fourth-party risk review.

Onfleet hosts on AWS. Data residency details are on its trust center.

Onfleet's trust center is at https://security.onfleet.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

You can report potential security issues to security@onfleet.com

Onfleet’s Data Protection Policy aligns with the Fair Information Protection Principles and Data Protection Principles as defined by the General Data Protection Regulation (GDPR). Onfleet collects and uses personal data fairly, for lawful purposes only. Onfleet has implemented appropriate safeguards to protect customer data against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access. You can read more about our Privacy Policy at https://privacy.onfleet.com/policies?name=privacy-notice

We aim to develop products that meet our customers’ needs and enhance the security and protection of their information. Onfleet supports single sign-on (SSO) via the SAML 2.0 protocol, enabling enterprise customers to log into Onfleet with their organization’s existing system. Our product also provides customers the ability to track certain user activity within the application, such as task assignments and completion.

All Onfleet employees complete security and data privacy training upon hire. All employees, regardless of their tenure, participate in live security and privacy training on an annual basis. We also provide specific role-based privacy and security training upon hire and on an annual basis.

Onfleet performs background checks on all employees prior to employment. Users are not granted access to Onfleet systems until this has been performed as part of onboarding

Onfleet encrypts data at rest utilizing AES-256 encryption

Onfleet operates in several jurisdictions using AWS cloud hosting infrastructure in the United States (US-East region). AWS has SOC 1, 2, and 3, ISO 27001, and FIPS certifications, in addition to meeting compliance standards for many other legal, security, and privacy frameworks. You can read more about AWS’ compliance practices and certifications here: Compliance Programs.

status.onfleet.com

Onfleet’s enterprise risk management program is designed to ensure the effective management of compliance risks by making accountabilities clear across the organization. Onfleet’s risk assessments evaluate all risks to the organization and are modeled after the NIST Risk Management Guide for Information Technology Systems, NIST SP 800-30. Key stakeholders conduct annual assessments that include a risk reduction action plan to manage or mitigate risks.

Onfleet has adopted an Information Security Program that has a multitude of policies including: Acceptable Use Policy Asset Management Policy Backup Policy Breach Notification Policy Business Continuity Plan Change Management Policy Code of Conduct Cryptography Policy Data Classification Policy Data Deletion Policy Data Protection Policy Disaster Recovery Plan Employee Privacy Notice Incident Response Plan Information Security Policy Password Policy Physical Security Policy Responsible Disclosure Policy Risk Assessment Program System Access Control Policy Vendor Management Policy Vulnerability Management Policy