Our Compliance Standards
Independently validated against the frameworks that matter to your organization.
Security Controls
Security Resources
Frequently Asked Questions
Where is Onboard's data stored?
Customer data is stored on Amazon Web Services (AWS), primarily in US-East (N. Virginia and Ohio). It is replicated within the United States for redundancy and disaster recovery.
How does Onboard protect my data?
Onboard takes the security and privacy of your data seriously. We use industry-standard security practices and technologies to protect your data from unauthorized access, disclosure, alteration, and destruction.
What is Onboard's incident response process?
Onboard has a comprehensive incident response process in place to quickly and effectively respond to security incidents. Our incident response team is trained to identify, contain, and mitigate security threats to protect our customers' data.
How does Onboard ensure data privacy?
Onboard is committed to protecting the privacy of your data. We have implemented strict data privacy policies and procedures to ensure that your data is handled securely and in compliance with applicable data protection laws.
How do I report a security vulnerability?
If you believe you have discovered a security vulnerability in Onboard's products or services, please report it to our security team at [email protected]. For reporting potential security vulnerabilities in our systems, please follow guidelines in our Responsible Disclosure Policy
What is SOC 2?
SOC 2 is a type of audit report that focuses on the security, availability, processing integrity, confidentiality, and privacy of a service organization's system. It is designed to help service organizations build trust and confidence in their service delivery processes and controls.
How do I get access to Onboard's SOC 2 report?
To request access to Onboard's SOC 2 report, please use our request form. You will be required to sign an NDA to get access to the SOC 2 Type 2 Report. Request security documents
Does Onboard use encryption to protect my data?
Yes. Data in transit is encrypted with TLS. Data at rest is stored on encrypted volumes using encryption keys managed by Onboard.
Latest Updates
- Subprocessor UpdatePublished November 5, 2026Added Plaid for identity verification and sanctions and watchlist screening for customers using Onboard Compliance. Identity document and selfie images are held by Plaid and are not stored by Onboard. Porter, already used for infrastructure deployment and management and to display application logs, is now classified as a subprocessor. We have also updated the description of Amazon Web Services to include AI model inference. To subscribe to subprocessor change notices or raise a question, email [email protected]. View Subprocessors
- 🆕 Updated SOC 2 Type II ReportCompleted August 5, 2026Our updated SOC 2 Type II audit report is now available in the Onboard Trust Center. Request Access
- Cookie Policy AddedPublished June 17, 2026A new cookie policy has been added, and a cookie banner with advanced cookie settings has been released on the onboard.io marketing website. View Cookie Policy
- Privacy Policy UpdatedPublished April 24, 2026Our Privacy Policy has been updated. View Privacy Policy
What's New:
- Expanded Third-Party Service Providers: We've updated our list to include new partners and subprocessors.
- U.S. State Privacy Laws Compliance: We've added specific provisions for residents of California, Colorado, Delaware, Florida, Virginia, and Utah, enhancing our compliance with state privacy regulations.
- California Privacy Enhancements: For our California users, we've detailed new rights and processes as per the CCPA and CPRA, including how to manage your personal information and our approach to financial incentives.
- Subprocessor UpdatePublished January 8, 2026Added Fora.day to subprocessors. View Subprocessors