Is this your company? Buyers are checking Onit here. Claim onit.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Onit
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Onit is SOC 2 Type II compliant. Onit also holds ISO 27001, HIPAA, and GDPR.
About
Onit takes a cutting-edge approach to security. It’s a top priority and one we take exceedingly seriously. Using state-of-the-art technology to ensure your data is protected, collaborating on projects securely (with access to only authorized participants) has never been easier. Physical security, application security, system security, operational security and policies and procedures all play an integral and equal role in this approach.
Compliance & infrastructure
Hosting
AWS
Subprocessors
29- AAffinda · PDF converter for BillingPoint UsersAustralia
- AAmazon Web Services (AWS) · Cloud ProviderCustomer can choose to host their data in the EU or US
- AAsana · Productivity ToolUnited States
- AAXDRAFT, LLC · Affiliate of Onit – various services, such as implementation, integration, dataUkraine
- BBusyLamp GmbH · Wholly owned subsidiary of OnitGermany
- CCenza Technologies Private Limited · AI Engine TrainingIndia
- CCloudflare · Security ToolingUnited States
- CConsortra · Translation ServicesUnited States
- CCrowdStrike · Hosting Managed Services and Security ServicesUnited States
- DDatadog · Server and Application Monitoring, Logging and AnalyticsUnited States
- GGoogle Suites · Email Provider and Productivity ToolsUnited States
- JJira · Productivity Tool / Ticketing SoftwareUnited States
Show all 29 subprocessorsShow fewer
- MMailgun · Email Automation ServiceUnited States
- MMicrosoft Office365 · Email Provider and Productivity SoftwareUnited States
- MMimecast · Email Archiving and Phishing Mitigation ToolUnited States
- mmonday.com · Productivity ToolUnited States
- OOnit Canada Ltd. · Various services, such as sales, implementation, integration, data migration, anCanada
- OOnit Europe Ltd. · Various services, such as implementation, integration, data migration, and suppoUnited Kingdom
- OOnit India Pvt. Limited · Wholly owned subsidiary of Onit –various services, such as implementation, integIndia
- OOnit New Zealand Limited · Wholly owned subsidiary of Onit – various services, such as implementation, inteNew Zealand
- OOnit, Inc. and its US affiliates: AXDRAFT, Inc.; Bodhala Inc.; SecureDocs, Inc.; SimpleLegal, Inc., LegalFiles Software, · Various services, such as implementation, integration, data migration, and suppoUnited States
- OOpenAI · API to AI tool that generates natural language or codeUnited States & Worldwide
- PPlanHat · Customer success toolUnited States
- SSalesforce.com · CRM SoftwareUnited States
- SSmartSheet · Productivity ToolUnited States
- TTeledirect · Call Center ProviderUnited States
- UUserWay Inc. · Translates web pages to conform to the Web Content Accessibility Guidelines (WCAUnited States
- WWorkato · Integration PlatformUnited States
- SSurePoint Technologies, Inc. · Logging and AnalyticsUnited States
Compliance leadership
The person who leads Onit's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Onit's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Onit SOC 2 compliant?
Onit is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Onit ISO 27001 certified?
According to Onit's public trust center, Onit is ISO 27001 certified. On SOC2C this listing is Listed.
Is Onit HIPAA compliant?
According to Onit's public trust center, Onit is HIPAA compliant. On SOC2C this listing is Listed.
Is Onit GDPR compliant?
According to Onit's public trust center, Onit is GDPR compliant. On SOC2C this listing is Listed.
Is Onit SOC 2 Type I or Type II?
Onit is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Onit's SOC 2 for a vendor risk assessment?
Yes. Onit's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Onit penetration tested?
Onit hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Onit secure?
Security isn't a single yes/no, but Onit is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, HIPAA, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Onit have a bug bounty or vulnerability disclosure program?
Onit hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@onit.com or via a /security page.
Who are Onit's subprocessors?
Onit lists 29 subprocessors on its trust center, including Affinda, Amazon Web Services (AWS), Asana, AXDRAFT, LLC, BusyLamp GmbH. Buyers use this for fourth-party risk review.
Where does Onit host or store data?
Onit hosts on AWS. Data residency details are on its trust center.
Where is Onit's trust center or security page?
Onit's trust center is at https://trust.onit.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
How is access controlled?
Access requests must be approved by a designated system owner, manager and are documented within our IT Support Application, which maintains audit logs. Upon employee termination, Human Resources Team and Information Technology Team follow a standardized checklist to ensure prompt deactivation of user accounts.
Is Multi-factor Authentication deployed?
Yes. Onit uses multi-factor authentication through its identity provider (IDP) on all critical systems.
Who at the provider can access client's environment and/ or data?
Only authorized personnel with a business need can access client environments or data. Access is role-based, requires MFA, and is logged. Support staff may only access data relevant to their tasks and are prohibited from storing it locally. All employees sign strict confidentiality agreements, and any misuse results in immediate termination.
Are Scoped Systems and Data used in the test, development, or QA environments?
Scoped systems or data are never used in test, development, or QA environments without explicit client permission. Otherwise, all data is sanitized before use.
Are applications evaluated from a security perspective prior to promotion to production?
Yes, before any code is released to production, it undergoes security scans, static code analysis, peer review, coding standards checks, and thorough testing to ensure system and data integrity.
Do you have an SDLC process.
Yes, we follow an SDLC Process. Please see our SDLC Policy in the Resources tab.
Does your solution support Single Sign-On (SSO)?
Yes. Onit supports SSO via SAML, OpenID, Azure AD, ADFS, LDAP, Ping Federate, and other identity providers.
Is there a documented change management/change control process?
Yes. Onit has a documented change management process using internal tools to log changes, testing, documentation, and version control. For full details, see our Change Management Policy in the Resources tab.
Are company owned workstations encrypted?
Yes, all company owned workstations with 256-bit key encryption.
Are controls in place to remote wipe / remote lock company owned workstations?
Yes. Onit uses a Device Management solution on all company-owned workstations, enabling remote wipe and lock capabilities for lost or stolen devices.
Are employee workstations automatically locked after a certain amount of time?
Yes, Onit had deployed a device management solution that enforces a screen lockout after 15 minutes of inactivity.
Do you allow usage of removable media?
Onit restricts removable media use through Endpoint Protection on all workstations, especially for employees with access to client data.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public