Draft for internal review. Compliance statuses, documents, controls and subprocessors are placeholders until confirmed in src/content/trust.ts.
Controls
How we protect your data
The security controls OnCore operates across infrastructure, access, product, monitoring and the organization.
Infrastructure security
- Production runs in isolated cloud accounts per environment
- Network access restricted by security groups and private subnets
- Encryption at rest for databases, caches and storage
- Encryption in transit with TLS for every public endpoint
Access control
- Multi-factor authentication required for cloud console access
- Least-privilege roles for services and staff
- Access reviews performed periodically
- Unique accounts for every team member
Product security
- API authentication with per-tenant keys
- Webhook payloads signed with a per-tenant secret
- Data retention and deletion audits for customer data
- Dependency vulnerability scanning in CI
Monitoring and resilience
- Centralized logging and alerting for production services
- Disaster recovery region for call routing
- Automatic failover of calls when the platform is degraded
- Audit logging of administrative actions
Organizational security
- Security policies acknowledged by every employee
- Security awareness training
- Vendor risk reviews for subprocessors
- Incident response plan maintained and tested