Security and compliance

What you'd ask the auditor

The current state of every framework we touch, updated as the clocks advance. No "in progress" hand-waving.

Compliance posture per standard: status, what exists
Standard	Status	What exists
GDPR	Controls in place	DPA · RoPA · DSAR pipeline · Sub-processor list · Right-to-erasure
NIS2 Article 21 + 23	Evidence pack live	Coverage taxonomy doc · Quarterly regulatory update brief
SOC 2 Type II	Controls in place, clock not started	Controls in place; auditor engagement and observation window start with our first enterprise customer
ISO 27001	Not started, deferred until revenue justifies the ISMS	Policy set + control mapping ready for an auditor; deferred until revenue justifies the ISMS build

Where your data lives

Your region, pinned: Every workspace is pinned to a home region at creation: EU workspaces run in AWS eu-central-1 (Frankfurt, Germany), US workspaces in AWS us-east-1. No cross-region replication, no fallback outside your region.
Encryption: TLS 1.2+ in transit (1.3 negotiated where supported). AES-256 at rest on RDS (via AWS KMS) and on S3 document storage.
Encryption keys: AWS KMS, managed by OnTrackio; customer-managed keys are not offered.
Database-per-tenant: Every customer gets a physically isolated PostgreSQL database via stancl/tenancy. Cross-tenant leaks aren't a category of bug we can introduce by accident.
Backups: Encrypted RDS snapshots daily, with point-in-time recovery, on a 7-day automated retention window. Resident in the workspace's own region; not copied cross-region.

Identity and access

SSO: Google Workspace and Microsoft Entra ID on every tier, with generic SAML 2.0 on Business and above, configured per tenant, with allowed-domain enforcement and named-collaborator bypass.
MFA: TOTP + WebAuthn passkeys. Org policy enforces MFA for admins or for all users. SAML SSO falls back to local TOTP when the IdP's MFA assertion is missing.
SCIM 2.0 Business: Joiner, mover, and leaver provisioning from Okta and Entra. Group-to-role mapping with audit-logged automatic grant and revoke.
Access lifecycle: A joiner or leaver run is built from an access bundle, then grants or revokes the real accounts and records what it did. Outbound writes to Google Workspace and Slack need Business or above. Where a write is not available the step is kept as a manual task with a deep link, so a skipped account is visible rather than silent.
Policy acknowledgement Business: Publish a policy version and collect employee read-and-sign acknowledgements. Each signature is bound to the version the person actually read, with IP, user agent and timestamp. The NIS2 21(2) evidence pack can then report how many of the current audience have signed, instead of the checksum of a file nobody opened.
Admin IP allowlist Enterprise: Per-tenant CIDR list on /admin/*. Per-API-token CIDR for machine integrations.

We're a data processor for tenant data and a data controller for our own marketing pipeline. The split is documented in the DPA.

Article 5, 6, 12 to 22, 25, 32, 33, 34: Implemented: lawfulness, transparency, data subject rights, privacy by design, security of processing, and breach notification.
DPA available on request: Request from privacy@ontrackio.com.
DSAR pipeline: Email privacy@ontrackio.com; statutory 30-day response per Article 12(3).
Right to erasure (Article 17): Implemented as pseudonymisation rather than hard delete, so your audit trail stays intact per EDPB Guidelines 04/2025.
Article 30 RoPA: Maintained internally; customer-facing extract available on request.

What our NIS2 pack covers

We map your asset and identity state to Article 21 sub-controls (a to j) and the Article 23 24-hour incident-notification workflow. Every claim is labelled with its evidence class:

NIS2 Article 21(2) checklist

ITAM-native evidence: OnTrackio produces full evidence for this slice directly.
ITAM hygiene floor: OnTrackio contributes a necessary baseline; you produce the rest.
ITAM proxy: OnTrackio contributes a coverage metric, not direct control evidence.
Outside ITAM scope: This evidence has to come from your own programme.

Compliance is still your responsibility as data controller. We hand you the evidence, not the legal attestation.

Who else touches your data

Per GDPR Article 28(2). Material changes get 30 days' notice before they take effect.

Sub-processors: vendor, purpose, processing region and the vendor's data processing agreement
Vendor	Purpose	Region	DPA
Amazon Web Services (AWS)	Compute, database, object storage, KMS, CDN, DNS	eu-central-1 (Frankfurt) or us-east-1, per workspace	View the Amazon Web Services (AWS) DPA
Cal.com	Demo call scheduling	EU instance	View the Cal.com DPA
Amazon SES	Transactional email delivery	eu-central-1 (Frankfurt)	View the Amazon SES DPA
Stripe	Billing + tax calculation	Ireland (EU)	View the Stripe DPA
Cloudflare	Cookieless website analytics (no Customer Data)	Global (US); DPA + SCCs	View the Cloudflare DPA

Company

Company facts

Legal entity: OnTrackio ITAM UAB, Vilnius, Lithuania
Founded: 2026
Support: Acknowledged within one business day
Data on termination: Read-only access for 30 days while you export. Full CSV/JSON export of every table from the admin panel. After 30 days the tenant database is dropped per the data-retention policy.
Status page: app.ontrackio.com/status
SLA: Custom SLA on Enterprise

This website

Cookies: None until you accept Google Analytics in the banner, and none at all if you decline
Fonts: Served from ontrackio.com
Analytics: Cloudflare Web Analytics counts visits without cookies and always runs. Google Analytics runs only if you accept it in the cookie banner, and sets cookies only then. Decline and we remember it.
Embeds: The booking calendar loads from app.cal.eu when you scroll to it
Chat widgets and ad pixels: None

Scope and boundaries

Endpoint agent

We collect installed apps and daily usage only, never keystrokes, window titles, or file contents.

Agent documentation

What we are not

A GRC platform. Vanta, Drata and AuditBoard are; we produce ITAM evidence they can consume.
A DORA or AI Act pack. NIS2 is the only compliance pack.
Self-hostable. OnTrackio is cloud only.
SOC 2 Type II: Controls in place, clock not started.
ISO 27001: Not started, deferred until revenue justifies the ISMS.
Customer-managed encryption keys. Keys are AWS KMS, managed by OnTrackio.

Contact

Vulnerability disclosure

Email security@ontrackio.com, also published at /.well-known/security.txt. We acknowledge within one business day, and run 90-day coordinated disclosure, extendable on request. We're glad to credit you publicly.

Privacy and DSAR

Email privacy@ontrackio.com for data-subject requests, DPA copies, or the sub-processor list. Statutory 30-day response per Article 12(3).