Our Compliance Standards
Independently validated against the frameworks that matter to your organization.
Security Controls
Security Resources
Frequently Asked Questions
Where is Onboard's data stored?
Customer data is stored on Amazon Web Services (AWS), primarily in US-East (N. Virginia and Ohio). It is replicated within the United States for redundancy and disaster recovery.
How does Onboard protect my data?
Onboard takes the security and privacy of your data seriously. We use industry-standard security practices and technologies to protect your data from unauthorized access, disclosure, alteration, and destruction.
What is Onboard's incident response process?
Onboard has a comprehensive incident response process in place to quickly and effectively respond to security incidents. Our incident response team is trained to identify, contain, and mitigate security threats to protect our customers' data.
How does Onboard ensure data privacy?
Onboard is committed to protecting the privacy of your data. We have implemented strict data privacy policies and procedures to ensure that your data is handled securely and in compliance with applicable data protection laws.
How do I report a security vulnerability?
If you believe you have discovered a security vulnerability in Onboard's products or services, please report it to our security team at [email protected]. For reporting potential security vulnerabilities in our systems, please follow guidelines in our Responsible Disclosure Policy
What is SOC 2?
SOC 2 is a type of audit report that focuses on the security, availability, processing integrity, confidentiality, and privacy of a service organization's system. It is designed to help service organizations build trust and confidence in their service delivery processes and controls.
How do I get access to Onboard's SOC 2 report?
To request access to Onboard's SOC 2 report, please use our request form. You will be required to sign an NDA to get access to the SOC 2 Type 2 Report. Request security documents
Does Onboard use encryption to protect my data?
Yes. Data in transit is encrypted with TLS. Data at rest is stored on encrypted volumes using encryption keys managed by Onboard.
Latest Updates
- 🆕 Updated SOC 2 Type II ReportCompleted August 5, 2026Our updated SOC 2 Type II audit report is now available in the Onboard Trust Center. Request Access
- Cookie Policy AddedPublished June 17, 2026A new cookie policy has been added, and a cookie banner with advanced cookie settings has been released on the onboard.io marketing website. View Cookie Policy
- Privacy Policy UpdatedPublished April 24, 2026Our Privacy Policy has been updated. View Privacy Policy
What's New:
- Expanded Third-Party Service Providers: We've updated our list to include new partners and subprocessors.
- U.S. State Privacy Laws Compliance: We've added specific provisions for residents of California, Colorado, Delaware, Florida, Virginia, and Utah, enhancing our compliance with state privacy regulations.
- California Privacy Enhancements: For our California users, we've detailed new rights and processes as per the CCPA and CPRA, including how to manage your personal information and our approach to financial incentives.
- Subprocessor UpdatePublished January 8, 2026Added Fora.day to subprocessors. View Subprocessors
- Subprocessor UpdatePublished October 28, 2025Added Membrane (Integration.app) to subprocessors. View Subprocessors
- Trust Center UpdatePublished July 31, 2024We are excited to announce that our Trust Center has been upgraded. This enhancement will provide more comprehensive and transparent security and compliance information for our customers.
- Onboard Subprocessor UpdatePublished July 17, 2024We are pleased to announce that Onboard has successfully completed our migration from Heroku to Amazon Web Services (AWS) and Kubernetes.
- 🆕 SOC 2 Type 2 ReportPublished June 11, 2024The SOC 2 Type II audit report for 2024 is available now in the Onboard Trust Center.