Trust & Data Control Center
Your security and privacy are our top priorities. We believe in complete transparency about how we handle your data, the controls you have, and our commitment to protecting your information.
Your Data Rights & Controls
You own your data. We provide the tools and transparency to exercise your rights.
Data Export
Export all your data at any time in standard formats (JSON, CSV). Full data portability with no vendor lock-in. Exports include all metrics, configurations, and historical data.
Right to Deletion
Request complete deletion of your account and all associated data. We process deletion requests within 30 days and provide a deletion certificate for your records.
Access Your Data
Request a complete copy of all personal data we hold about you. Includes account information, usage logs, and any automated decisions made about your account.
Rectification
Correct any inaccurate personal data we hold. Update your profile directly in the dashboard or contact us for corrections to data you cannot modify yourself.
Opt-Out Controls
Control marketing communications, analytics, and optional data collection. Manage your preferences directly from your account settings or unsubscribe from any email.
Data Residency
Choose your data region at signup — EU, US, or Asia-Pacific. Data residency is available on all plans and cannot be changed after your organisation is created.
Data Collection Transparency
Complete transparency about what data we collect and why. No hidden data collection.
| Data Type | Purpose | Collection | Retention | Shared With |
|---|---|---|---|---|
| Server Metrics CPU, memory, disk, network |
Core monitoring functionality | Required | Based on plan (7-365 days) | Not shared externally |
| Network Connections IP addresses, ports, protocols |
Topology mapping & troubleshooting | Required | Based on plan (7-365 days) | Not shared externally |
| Process Information Process names, PIDs, resource usage |
Application performance monitoring | Required | Based on plan (7-365 days) | Not shared externally |
| Account Information Email, name, company |
Account management & communication | Required | Account lifetime + 30 days | Payment processor (billing only) |
| Usage Analytics Feature usage, page views, cookies |
Product improvement & user experience | Optional | 26 months (Google Analytics) | Google Analytics |
| Application Payloads HTTP bodies, SQL queries |
Not collected | Never Collected | N/A | N/A |
| Passwords/Credentials User passwords, API secrets |
Not collected from agents | Never Collected | N/A | N/A |
| File Contents Document contents, source code |
Not collected | Never Collected | N/A | N/A |
Data Retention Policies
Clear retention periods with automatic deletion. You can request earlier deletion at any time.
| Plan | Metrics Retention | Logs Retention | Alert History | Audit Logs |
|---|---|---|---|---|
| Solo ($5/mo) | 7 days | 3 days | 30 days | 30 days |
| Pro | 30 days | 14 days | 90 days | 1 year |
| Enterprise | Custom (up to 2 years) | Custom (up to 1 year) | Custom (up to 2 years) | Custom (up to 7 years) |
Sub-processors & Third Parties
Complete list of third parties who may process your data on our behalf. All sub-processors are bound by strict data protection agreements.
Amazon Web Services (AWS)
Infrastructure hosting, data storage, and compute services
Stripe
Payment processing and billing management
Brevo
Transactional email delivery (alerts, notifications) and customer support chat
Google Analytics
Website analytics and usage tracking
Last updated: January 2026. We notify customers 30 days before adding new sub-processors.
Security Standards & Compliance
We align our security controls with SOC 2 and ISO 27001 frameworks, and host on certified infrastructure to ensure your data is protected at every layer.
SOC 2 & ISO 27001 Aligned
OnePAM's security controls, policies, and procedures are built to meet SOC 2 and ISO 27001 standards. We follow these frameworks as our security baseline to ensure enterprise-grade data protection by design.
Certified Hosting Partners
Our hosting providers are independently certified ISO 27001:2022 and BSI C5. Their certifications ensure that the data centers housing your data meet rigorous international standards for information security management and cloud security.
GDPR Compliant
We fully comply with the EU General Data Protection Regulation. We provide data processing agreements, support data subject rights, and maintain transparent data practices for all European customers.
CCPA Ready
We support California Consumer Privacy Act requirements, including the right to know, delete, and opt-out. Our privacy controls help you meet your CCPA obligations for California residents.
HIPAA Eligible
Enterprise customers can sign a Business Associate Agreement (BAA) for HIPAA compliance. We implement appropriate safeguards for protected health information (PHI) in healthcare environments.
DPA Available
We provide comprehensive Data Processing Agreements that outline our responsibilities as a data processor. Standard contractual clauses are available for international data transfers.
Security Controls
Comprehensive technical and organizational measures to protect your data.
Infrastructure Security
- Multi-layered firewall protection with intrusion detection and prevention systems (IDS/IPS)
- DDoS protection with automatic traffic scrubbing and rate limiting
- Network segmentation isolating production, staging, and development environments
- Regular vulnerability scanning and continuous automated security monitoring
Access Control
- Role-based access control (RBAC) with principle of least privilege
- Multi-factor authentication required for all employee and admin access
- SSO integration with Google (all plans), SAML/OIDC with any IDP (Pro/Enterprise)
- Domain-based user provisioning with DNS verification (Pro/Enterprise)
- Comprehensive audit logging of all access and administrative actions
Data Protection
- AES-256 encryption for data at rest with customer-managed key options
- TLS 1.3 encryption for all data in transit with perfect forward secrecy
- Automated daily backups with geo-redundant storage and tested recovery procedures
- Data isolation between tenants with logical and physical separation
Organizational Security
- Background checks for all employees with access to customer data
- Annual security awareness training and phishing simulations
- Documented security policies reviewed and updated quarterly
- Vendor security assessments for all third-party integrations
Gateway & Secrets Security
Full control over how access flows through your infrastructure and where secrets are stored.
Customer-Managed Gateways
- Deploy in your infrastructure — Install a OnePAM gateway directly within your network perimeter. The gateway handles all access protocols (SSH, RDP, VNC, database, web apps) without exposing internal resources to the internet.
- Restrict access to your gateway only — Business and Enterprise customers can enforce that all access to their resources must flow exclusively through their own customer-managed gateway. No traffic routes through OnePAM-hosted infrastructure.
- Managed by default — By default, gateways are managed by OnePAM with automatic failover. Customers who require full control can self-host and manage their own gateway instances.
- mTLS agent communication — All communication between agents and gateways uses mutual TLS (mTLS) with certificate pinning, ensuring no man-in-the-middle interception is possible.
Secret Isolation
- Gateway-side secret resolution — Credentials, SSH keys, and database passwords are resolved and used within the gateway. No secrets are transmitted to or stored on the OnePAM control plane.
- Local encrypted secret storage (Business+) — Business and Enterprise customers can store secrets locally within an AES-256 encrypted database on the agent. Secrets are encrypted at rest and inaccessible to the OnePAM control plane.
- Zero-knowledge architecture — OnePAM has no ability to read, decrypt, or access customer secrets stored in local vaults. Encryption keys are derived locally and never transmitted.
- Vault integration support — Enterprise customers can integrate with external secret managers (HashiCorp Vault, AWS Secrets Manager) for centralized secret lifecycle management while maintaining gateway-side resolution.
| Security Capability | Solo & Team | Business | Enterprise |
|---|---|---|---|
| Customer-managed gateway Install gateway in your infrastructure |
|||
| OnePAM-managed gateway Fully managed by OnePAM |
|||
| Gateway restriction Restrict to your own gateways only |
|||
| Gateway-side secret resolution Credentials resolved within your infrastructure |
|||
| Local encrypted secret storage AES-256 encrypted local vault on agent |
|||
| External vault integration HashiCorp Vault, AWS Secrets Manager |
Global Data Centers
Your data is hosted in world-class facilities with enterprise-grade security.
US East
Virginia, USA
US West
Oregon, USA
EU Central
Frankfurt, Germany
Asia Pacific
Sydney, Australia
Incident Response
Our rapid response process ensures minimal impact from security incidents.
Detection & Alerting
Our monitoring systems detect anomalies and automatically alert the security team. Initial triage begins immediately to assess severity and scope.
Containment
The incident response team implements containment measures to prevent further impact. Affected systems are isolated while maintaining service availability where possible.
Customer Notification
For incidents affecting customer data, we provide transparent communication within 24 hours. Status updates are posted to our status page and sent directly to affected customers.
Root Cause Analysis
A comprehensive post-incident review identifies root causes and lessons learned. We implement preventive measures and share relevant findings with customers.
Frequently Asked Questions
Common questions about our security practices and data handling.
Can I restrict access to flow only through my own gateway?
Where are my secrets stored? Can OnePAM access them?
How is my data protected at rest?
Can I choose where my data is stored?
How long does it take to process a data deletion request?
Does OnePAM sell my data to third parties?
What happens to my data if I cancel my account?
How can I report a security vulnerability?
What is your uptime SLA?
Have Security or Privacy Questions?
Our security and privacy teams are available to discuss your specific requirements, provide compliance documentation, or answer any questions about how we protect your data.