OneUptime · Compliance
OneUptime compliance
Read from OneUptime's own page on 2026-11-10. 13 statements quoted word for word; anything the page does not say is shown as unstated, never guessed. APIs.io verifies none of it.
Trust center
Attestations
framework: SOC2type: SOC 2 Type IIscope: security, availability, and confidentiality controlsperiod: renewed annuallyreport access: nda
SOC 2 Type II Security, availability, and confidentiality controls. Renewed annually, report under NDA.Read from OneUptime's own page on 2026-11-10
framework: SOC3type: SOC 3scope: general-use summary of the same examinationreport access: public
SOC 3 report, the general-use summary of the same examination. Shareable without an NDA.Read from OneUptime's own page on 2026-11-10
framework: ISO27001type: ISO/IEC 27001 certificationscope: OneUptime Cloud and the organisation that builds the platformreport access: on_request
Certificate of registration, including scope, on request.Read from OneUptime's own page on 2026-11-10
framework: ISO27017type: ISO/IEC 27017 certificationscope: cloud-services security controls extending ISO 27001report access: on_request
ISO/IEC 27017 cloud-services security controls, audited alongside ISO 27001.Read from OneUptime's own page on 2026-11-10
framework: ISO27018type: ISO/IEC 27018 certificationscope: protection of personally identifiable information in public cloudsreport access: on_request
ISO/IEC 27018 controls for protecting personally identifiable information in public clouds.Read from OneUptime's own page on 2026-11-10
framework: ISO9001type: ISO 9001 certificationscope: quality management system covering how the service is built and operatedreport access: on_request
ISO 9001 certified quality management system.Read from OneUptime's own page on 2026-11-10
framework: GDPRtype: GDPR compliance as processorscope: Data Processing Addendum, Standard Contractual Clauses, EU data residency availablereport access: unstated
GDPR compliant as a processor, with a Data Processing Addendum, Standard Contractual Clauses, and EU data residency available.Read from OneUptime's own page on 2026-11-10
framework: CCPAtype: CCPA / CPRA compliancescope: consumer privacy rights honoured for all customersreport access: unstated
CCPA and CPRA compliant, with consumer privacy rights honoured for all customers.Read from OneUptime's own page on 2026-11-10
framework: HIPAAtype: HIPAA compliance as business associatescope: Business Associate Agreement available for covered entitiesreport access: unstated
HIPAA compliant as a business associate, with a Business Associate Agreement available for covered entities.Read from OneUptime's own page on 2026-11-10
framework: PCI-DSStype: PCI DSS attestationscope: cardholder data handled by payment providers; OneUptime does not store primary account numbersissuer: Qualified Security Assessorreport access: on_request
PCI DSS compliance validated by a Qualified Security Assessor, with a signed Attestation of Compliance.Read from OneUptime's own page on 2026-11-10
framework: CSA-STARtype: CSA STAR Level 2 certificationscope: Cloud Controls Matrix, with CAIQ published to the STAR registryreport access: public
CSA STAR Level 2 certified against the Cloud Controls Matrix, with our CAIQ published to the STAR registry.Read from OneUptime's own page on 2026-11-10
framework: FedRAMPtype: FedRAMP Moderate authorizationscope: OneUptime Cloudreport access: unstated
FedRAMP Moderate authorization is in progress. Not yet authorized, and no date is promised.Read from OneUptime's own page on 2026-11-10
framework: othertype: Penetration testingscope: independent third-party penetration testingperiod: at least annuallyreport access: nda
Independent third-party penetration testing at least annually. Summary reports are available under NDA to qualifying customers.Read from OneUptime's own page on 2026-11-10
Document
Download YAML · schema: API Commons Compliance 0.1.0 · transcribed by claude-haiku-5-5, checked verbatim against the fetched page