generated: '2026-08-13' method: searched source: https://documentation.onesignal.com/docs/en/data-questions provider: OneSignal providerId: onesignal description: >- OneSignal publishes its security and compliance posture as documentation rather than as a hosted trust portal. The certifications are named specifically — SOC 2 Type II, ISO 27001, ISO 27701, EU-U.S. Data Privacy Framework — each with its own documentation page. Report artifacts themselves are not publicly downloadable. trust_center: hosted_portal: false primary_url: https://documentation.onesignal.com/docs/en/data-questions probed: - url: https://trust.onesignal.com status: 200 - url: https://security.onesignal.com status: 200 - url: https://onesignal.com/security status: 404 - url: https://onesignal.com/trust status: 404 probe_note: >- trust.onesignal.com and security.onesignal.com both answer 200, but the canonical, linked and content-bearing compliance surface OneSignal points customers at is the Data collection & security FAQ in the documentation. certifications: - name: SOC 2 Type II status: certified url: https://documentation.onesignal.com/docs/en/soc-2-type-ii report_public: false - name: ISO 27001 status: certified url: https://documentation.onesignal.com/docs/en/iso27001 - name: ISO 27701 status: certified url: https://documentation.onesignal.com/docs/en/iso27001 note: Privacy information management system certification, held alongside ISO 27001. - name: EU-U.S. Data Privacy Framework status: certified note: Certified for lawful EU-to-U.S. data transfers. regulatory_programs: - name: HIPAA status: compliant url: https://documentation.onesignal.com/docs/en/hipaa baa_available: true baa_gate: Enterprise plan only, via sales note: OneSignal completed a HIPAA risk assessment against the security and privacy rules, leveraging its SOC 2 Type II work. - name: GDPR status: compliant url: https://documentation.onesignal.com/docs/en/gdpr-compliance role: data processor (the customer is the data controller) note: Primary data centers are located in the European Union. - name: COPPA status: partial detail: OneSignal is certified under the Families Ads Program (as of 2022-01-10). COPPA compliance itself remains the publisher's responsibility; OneSignal provides consent-collection tooling. - name: CAN-SPAM / email regulatory compliance url: https://documentation.onesignal.com/docs/en/email-compliance - name: SMS regulatory compliance url: https://documentation.onesignal.com/docs/en/sms-regulatory-compliance security_practices: - name: Third-party security assessment cadence: annual - name: Vulnerability and penetration scans cadence: quarterly note: All critical and high-severity findings remediated promptly. - name: Encryption in transit detail: TLS 1.2+ - name: Encryption at rest detail: AES-256 - name: Incident response program detail: Documented program to detect, contain and remediate security incidents. - name: Dedicated security organization detail: A standing Security Team monitors, triages and responds to security events. - name: Workstation security detail: Firewall and endpoint protection, full disk encryption, automatic patch management on all employee workstations. - name: Personnel security detail: Background checks and regular security awareness training for all employees. - name: Single sign-on detail: SSO via WorkOS, integrating major identity providers. url: https://documentation.onesignal.com/docs/en/sso - name: Two-step authentication detail: Organization administrators can enforce 2FA for all team members. - name: Audit logs detail: Organization-wide user activity tracking, exportable to JSONL or queryable via the REST API (list-audit-logs). url: https://documentation.onesignal.com/docs/en/audit-logs - name: PII masking detail: Email addresses and phone numbers can be hidden from the dashboard and from data exports. password_policy: minimum_length: 8 breached_password_check: true rotation_required: false maintainers: - FN: Kin Lane email: kin@apievangelist.com