Onesignal Trust Center

generated: '2026-08-13'
method: searched
source: https://documentation.onesignal.com/docs/en/data-questions
provider: OneSignal
providerId: onesignal
description: >-
  OneSignal publishes its security and compliance posture as documentation
  rather than as a hosted trust portal. The certifications are named
  specifically — SOC 2 Type II, ISO 27001, ISO 27701, EU-U.S. Data Privacy
  Framework — each with its own documentation page. Report artifacts themselves
  are not publicly downloadable.
trust_center:
  hosted_portal: false
  primary_url: https://documentation.onesignal.com/docs/en/data-questions
  probed:
  - url: https://trust.onesignal.com
    status: 200
  - url: https://security.onesignal.com
    status: 200
  - url: https://onesignal.com/security
    status: 404
  - url: https://onesignal.com/trust
    status: 404
  probe_note: >-
    trust.onesignal.com and security.onesignal.com both answer 200, but the
    canonical, linked and content-bearing compliance surface OneSignal points
    customers at is the Data collection & security FAQ in the documentation.
certifications:
- name: SOC 2 Type II
  status: certified
  url: https://documentation.onesignal.com/docs/en/soc-2-type-ii
  report_public: false
- name: ISO 27001
  status: certified
  url: https://documentation.onesignal.com/docs/en/iso27001
- name: ISO 27701
  status: certified
  url: https://documentation.onesignal.com/docs/en/iso27001
  note: Privacy information management system certification, held alongside ISO 27001.
- name: EU-U.S. Data Privacy Framework
  status: certified
  note: Certified for lawful EU-to-U.S. data transfers.
regulatory_programs:
- name: HIPAA
  status: compliant
  url: https://documentation.onesignal.com/docs/en/hipaa
  baa_available: true
  baa_gate: Enterprise plan only, via sales
  note: OneSignal completed a HIPAA risk assessment against the security and privacy
    rules, leveraging its SOC 2 Type II work.
- name: GDPR
  status: compliant
  url: https://documentation.onesignal.com/docs/en/gdpr-compliance
  role: data processor (the customer is the data controller)
  note: Primary data centers are located in the European Union.
- name: COPPA
  status: partial
  detail: OneSignal is certified under the Families Ads Program (as of 2022-01-10).
    COPPA compliance itself remains the publisher's responsibility; OneSignal provides
    consent-collection tooling.
- name: CAN-SPAM / email regulatory compliance
  url: https://documentation.onesignal.com/docs/en/email-compliance
- name: SMS regulatory compliance
  url: https://documentation.onesignal.com/docs/en/sms-regulatory-compliance
security_practices:
- name: Third-party security assessment
  cadence: annual
- name: Vulnerability and penetration scans
  cadence: quarterly
  note: All critical and high-severity findings remediated promptly.
- name: Encryption in transit
  detail: TLS 1.2+
- name: Encryption at rest
  detail: AES-256
- name: Incident response program
  detail: Documented program to detect, contain and remediate security incidents.
- name: Dedicated security organization
  detail: A standing Security Team monitors, triages and responds to security events.
- name: Workstation security
  detail: Firewall and endpoint protection, full disk encryption, automatic patch management
    on all employee workstations.
- name: Personnel security
  detail: Background checks and regular security awareness training for all employees.
- name: Single sign-on
  detail: SSO via WorkOS, integrating major identity providers.
  url: https://documentation.onesignal.com/docs/en/sso
- name: Two-step authentication
  detail: Organization administrators can enforce 2FA for all team members.
- name: Audit logs
  detail: Organization-wide user activity tracking, exportable to JSONL or queryable
    via the REST API (list-audit-logs).
  url: https://documentation.onesignal.com/docs/en/audit-logs
- name: PII masking
  detail: Email addresses and phone numbers can be hidden from the dashboard and from
    data exports.
password_policy:
  minimum_length: 8
  breached_password_check: true
  rotation_required: false
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com