Draft for internal review. Compliance statuses, documents, controls and subprocessors are placeholders until confirmed in src/content/trust.ts.
OnCore Trust Center
Security and compliance at OnCore
OnCore answers your customers' calls and messages, so we protect their data like our own. Review our compliance posture, controls and subprocessors, and request the reports your security team needs.
Compliance
Frameworks OnCore is audited or assessed against.
Independent audit of security, availability and confidentiality controls.
In progressSafeguards for protected health information, with a Business Associate Agreement on request.
CompliantData protection for EU and UK personal data, with a Data Processing Agreement on request.
CompliantResources
Reports and agreements, shared after a quick review.
SOC 2 Type II report
Full auditor's report covering the most recent observation period.
SOC 2 bridge letter
Covers the period between the last report and today.
HIPAA compliance summary
How OnCore safeguards protected health information.
Penetration test summary
Executive summary of the latest third-party penetration test.
Controls
How we secure the platform, grouped by area.
Infrastructure security
- Production runs in isolated cloud accounts per environment
- Network access restricted by security groups and private subnets
Access control
- Multi-factor authentication required for cloud console access
- Least-privilege roles for services and staff
Product security
- API authentication with per-tenant keys
- Webhook payloads signed with a per-tenant secret
Monitoring and resilience
- Centralized logging and alerting for production services
- Disaster recovery region for call routing
Organizational security
- Security policies acknowledged by every employee
- Security awareness training
Subprocessors
Third parties that process customer data on our behalf.
| Name | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, caching and Bedrock models | US, Australia |
| PlanetScale | Managed database | US, Australia |
| LiveKit | Real-time voice transport and SIP | US, Australia |
| Twilio | Telephony, SMS and call transfers | US |
| Telnyx | Telephony | US |
| Meta | WhatsApp messaging | US |
Frequently asked questions
How do I get a copy of the SOC 2 report or the BAA?
Select the documents you need and send a request. We review every request and reply by email, usually within two business days. Some documents require a signed NDA.
Does OnCore sign a Business Associate Agreement?
Yes. Customers who process protected health information can request our standard BAA from this page.
How do I report a security issue?
Email [email protected] with the details. We acknowledge reports promptly and keep you updated until the issue is resolved.