Is this your company? Buyers are checking Onfleet here. Claim onfleet.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Onfleet
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Onfleet is SOC 2 Type II compliant. Onfleet also holds CCPA, and GDPR.
About
Onfleet prioritizes security and privacy with enterprise-wide security protocols and privacy standards. We understand that protecting customer data requires an established privacy program and rigorous security controls. Onfleet’s security and privacy program demonstrates our commitment to customers and applicable laws and regulations. For any inquiries about our program, please email us at [privacy@onfleet.com](mailto:privacy@onfleet.com). If you are a security researcher and you believe you have discovered a flaw or vulnerability in the Onfleet application or website please report all these f
Compliance & infrastructure
Hosting
AWS
Documents
1Documents
Subprocessors
9- AAmazon Web Services · Data processing and storageUnited States
- AAuth0 · Identity providerUnited States
- MMongoDB · Data HostingUnited States
- DDatadog · Infrastructure MonitoringUnited States
- GGoogle Workspace · Email communication and document retetionUnited States
- ZZendesk · Customer supportUnited States
- RRedis · Data StorageUnited States
- GGitHub · Code RepositoryUnited States
- CCheckr · Background Check ProviderUnited States
Compliance leadership
The person who leads Onfleet's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Onfleet's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Onfleet SOC 2 compliant?
Onfleet is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Onfleet CCPA compliant?
According to Onfleet's public trust center, Onfleet is CCPA compliant. On SOC2C this listing is Listed.
Is Onfleet GDPR compliant?
According to Onfleet's public trust center, Onfleet is GDPR compliant. On SOC2C this listing is Listed.
Is Onfleet SOC 2 Type I or Type II?
Onfleet is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Onfleet's SOC 2 for a vendor risk assessment?
Yes. Onfleet's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Onfleet penetration tested?
Onfleet hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Onfleet's SOC 2 report?
Onfleet's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Onfleet secure?
Security isn't a single yes/no, but Onfleet is SOC 2 Type II compliant and holds SOC 2 Type II, CCPA, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Onfleet have a bug bounty or vulnerability disclosure program?
Onfleet hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@onfleet.com or via a /security page (Onfleet lists a security contact).
Who are Onfleet's subprocessors?
Onfleet lists 9 subprocessors on its trust center, including Amazon Web Services, Auth0, MongoDB, Datadog, Google Workspace. Buyers use this for fourth-party risk review.
Where does Onfleet host or store data?
Onfleet hosts on AWS. Data residency details are on its trust center.
Where is Onfleet's trust center or security page?
Onfleet's trust center is at https://security.onfleet.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Onfleet
Reproduced from Onfleet's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Want to report a potential security issue?
You can report potential security issues to security@onfleet.com
What is your privacy policy?
Onfleet’s Data Protection Policy aligns with the Fair Information Protection Principles and Data Protection Principles as defined by the General Data Protection Regulation (GDPR). Onfleet collects and uses personal data fairly, for lawful purposes only. Onfleet has implemented appropriate safeguards to protect customer data against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access. You can read more about our Privacy Policy at https://privacy.onfleet.com/policies?name=privacy-notice
Do you support Single Sign-On (SSO)?
We aim to develop products that meet our customers’ needs and enhance the security and protection of their information. Onfleet supports single sign-on (SSO) via the SAML 2.0 protocol, enabling enterprise customers to log into Onfleet with their organization’s existing system. Our product also provides customers the ability to track certain user activity within the application, such as task assignments and completion.
Do you provide security awareness training?
All Onfleet employees complete security and data privacy training upon hire. All employees, regardless of their tenure, participate in live security and privacy training on an annual basis. We also provide specific role-based privacy and security training upon hire and on an annual basis.
Do you perform background checks?
Onfleet performs background checks on all employees prior to employment. Users are not granted access to Onfleet systems until this has been performed as part of onboarding
Do you encrypt data at rest?
Onfleet encrypts data at rest utilizing AES-256 encryption
Where are your servers located?
Onfleet operates in several jurisdictions using AWS cloud hosting infrastructure in the United States (US-East region). AWS has SOC 1, 2, and 3, ISO 27001, and FIPS certifications, in addition to meeting compliance standards for many other legal, security, and privacy frameworks. You can read more about AWS’ compliance practices and certifications here: Compliance Programs.
Where can I see if your application is working?
status.onfleet.com
Do you have a Risk Management Policy?
Onfleet’s enterprise risk management program is designed to ensure the effective management of compliance risks by making accountabilities clear across the organization. Onfleet’s risk assessments evaluate all risks to the organization and are modeled after the NIST Risk Management Guide for Information Technology Systems, NIST SP 800-30. Key stakeholders conduct annual assessments that include a risk reduction action plan to manage or mitigate risks.
Do you have an Information Security Policy?
Onfleet has adopted an Information Security Program that has a multitude of policies including: Acceptable Use Policy Asset Management Policy Backup Policy Breach Notification Policy Business Continuity Plan Change Management Policy Code of Conduct Cryptography Policy Data Classification Policy Data Deletion Policy Data Protection Policy Disaster Recovery Plan Employee Privacy Notice Incident Response Plan Information Security Policy Password Policy Physical Security Policy Responsible Disclosure Policy Risk Assessment Program System Access Control Policy Vendor Management Policy Vulnerability Management Policy
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public