Trust Center

Security, privacy, and compliance are foundational to the platform. This page is the authoritative source for Onam's certifications, security posture, policies, and compliance artifacts. Every claim below is independently audited or backed by a downloadable artifact.

Certifications and compliance status

The platform holds the major enterprise security certifications. Six are achieved, two are in progress, and three are on the roadmap. All achieved certifications are backed by current audit reports available on request.

Downloads

To request gated documents, email trust@onam.io. NDA-gated documents (SOC 2 report, full pentest report, PCI AOC) are typically turned around within two business days.

Security program

The security program is organized into five domains. Each domain has named owners, written policies (reviewable under NDA), and quarterly audit cycles. The summary below is the public-facing version; the full policy set is part of the SOC 2 audit report.

Penetration testing

Independent third-party security firms conduct annual penetration tests covering:

• External network penetration testing
• Web application security testing (OWASP Top 10)
• API security testing
• Privilege escalation and lateral movement
• Multi-tenant isolation validation
• Subprocessor boundary testing

A summary report is available on request; full reports are available under NDA for enterprise customers. Identified findings are remediated on the same SLA we promise customers — Critical within 7 days, High within 30, Medium within 90.

Data handling

The platform stores three classes of data: scan and finding data (your security posture), credential references (pointers to your IAM roles, never plaintext keys), and account metadata. Encryption, retention, and isolation rules are explicit per class.

We never store:

• Plaintext cloud credentials. Only credential references (ARNs, service principal IDs) are stored. The secret material lives in a managed secret store (AWS Secrets Manager, encrypted with KMS) and is fetched at scan time.
• Customer workload data or file contents. Data Security (DSPM) samples to classify data types — sample data is discarded immediately after classification metadata is extracted.
• Personal data from scanned cloud resources. The platform records that PII, PCI, or PHI exists, where it lives, and how it is protected — never the data itself.

Subprocessors

Customers are notified of material subprocessor changes 30 days in advance. The current list is published and updated whenever a change occurs; subscribe to change notifications at trust@onam.io.

Incident response

Security events are handled through a five-stage response process. Severity is classified within 1 hour of detection; customer notifications go out within 72 hours of confirming impact.

To report a security issue: security@onam.io. A GPG public key, a responsible disclosure policy, and a bug bounty program are all published on the website.

Business continuity

Security ratings

Live ratings auto-refresh on the trust center web page; score histories are available on request.

Contact

Trust Center updates are published when certifications are renewed or materially changed. Last updated: 2026-05-09.

Next steps

• Data Retention — what we store, for how long, and how deletion works
• SLA & SLO — uptime commitments, scan SLOs, and support response times
• Framework Coverage — the 70+ compliance frameworks the platform evaluates for you
• Book a demo — walk through the security architecture with our team