Security and compliance
Exactly what we run, where it runs, and what we have evidence for. Where an audit clock hasn't started yet, we say so plainly.
What you'd ask the auditor
The current state of every framework we touch, updated as the clocks advance. No "in progress" hand-waving.
| Standard | Status | Evidence available |
|---|---|---|
| GDPR | Controls in place | DPA · RoPA · DSAR pipeline · Sub-processor list · Right-to-erasure |
| NIS2 Article 21 + 23 | Evidence pack live | Coverage taxonomy doc · Quarterly regulatory update brief |
| SOC 2 Type II | Clock not yet started | Controls in place; auditor engagement and observation window start with our first enterprise customer |
| ISO 27001 | Not started | Policy set + control mapping ready for an auditor; deferred until revenue justifies the ISMS build |
Where your data lives
- Your region, pinned.
Every workspace is pinned to a home region at creation: EU
workspaces run in AWS
eu-central-1(Frankfurt, Germany), US workspaces in AWSus-east-1. No cross-region replication, no fallback outside your region. - Encryption. TLS 1.2+ in transit (1.3 negotiated where supported). AES-256 at rest on RDS (via AWS KMS) and on S3 document storage.
- Database-per-tenant.
Every customer gets a physically isolated PostgreSQL database via
stancl/tenancy. Cross-tenant leaks aren't a category of bug we can introduce by accident. - Backups. Encrypted RDS snapshots daily, with point-in-time recovery, on a 7-day automated retention window. Resident in the workspace's own region; not copied cross-region.
Identity & access
- SSO. Google Workspace and Microsoft Entra ID on every tier, with generic SAML 2.0 on Enterprise, configured per tenant, with allowed-domain enforcement and named-collaborator bypass.
- MFA. TOTP + WebAuthn passkeys. Org policy enforces MFA for admins or for all users. SAML SSO falls back to local TOTP when the IdP's MFA assertion is missing.
- SCIM 2.0 (Enterprise). Joiner, mover, and leaver provisioning from Okta and Entra. Group-to-role mapping with audit-logged automatic grant and revoke.
- Access lifecycle. A joiner or leaver run is built from an access bundle, then grants or revokes the real accounts and records what it did. Outbound writes to Google Workspace and Slack need Business or above. Where a write is not available the step is kept as a manual task with a deep link, so a skipped account is visible rather than silent.
- Policy acknowledgement (Business). Publish a policy version and collect employee read-and-sign acknowledgements. Each signature is bound to the version the person actually read, with IP, user agent and timestamp. The NIS2 21(2) evidence pack can then report how many of the current audience have signed, instead of the checksum of a file nobody opened.
- Admin IP allowlist (Enterprise).
Per-tenant CIDR list on
/admin/*. Per-API-token CIDR for machine integrations.
GDPR posture
We're a data processor for tenant data and a data controller for our own marketing pipeline. The split is documented in the DPA.
- Article 5, 6, 12 to 22, 25, 32, 33, 34 implemented: lawfulness, transparency, data subject rights, privacy by design, security of processing, and breach notification.
- DPA available on request. Request from privacy@ontrackio.com.
- DSAR pipeline. Email privacy@ontrackio.com; statutory 30-day response per Article 12(3).
- Right to erasure (Article 17) implemented as pseudonymisation rather than hard delete, so your audit trail stays intact per EDPB Guidelines 04/2025.
- Article 30 RoPA maintained internally; customer-facing extract available on request.
What our NIS2 pack covers
We map your asset and identity state to Article 21 sub-controls (a to j) and the Article 23 24-hour incident-notification workflow. Every claim is labelled with its evidence class:
-
itam_native_evidence: ITAM data is the primary proof (asset inventory, MFA enrolment rate). -
itam_hygiene_floor: ITAM provides the baseline; you still need policy work on top. -
itam_proxy: adjacent evidence; a real GRC system gives stronger coverage. -
outside_itam_scope: we don't help here. Vanta, Drata, and AuditBoard do.
Compliance is still your responsibility as data controller. We hand you the evidence, not the legal attestation.
Who else touches your data
Per GDPR Article 28(2). Material changes get 30 days' notice before they take effect.
| Vendor | Purpose | Region | DPA |
|---|---|---|---|
| Amazon Web Services (AWS) | Compute, database, object storage, KMS, CDN, DNS | eu-central-1 (Frankfurt) | View → |
| Cal.com | Demo call scheduling | EU instance | View → |
| Amazon SES | Transactional email delivery | eu-central-1 (Frankfurt) | View → |
| Stripe | Billing + tax calculation | Ireland (EU) | View → |
| Cloudflare | Cookieless website analytics (no Customer Data) | Global (US); DPA + SCCs | View → |
Vulnerability disclosure
Email security@ontrackio.com, also published at /.well-known/security.txt. We acknowledge within one business day, and run 90-day coordinated disclosure, extendable on request. We're glad to credit you publicly.
Privacy & DSAR
Email privacy@ontrackio.com for data-subject requests, DPA copies, or the sub-processor list. Statutory 30-day response per Article 12(3).
Want the security pack?
After a 30-min call we'll send the current Article 21 evidence pack, sub-processor list, DPA template, and a security questionnaire pre-filled.