Last reviewed October 29, 2026
Trust center
How we secure onebee, the reports and policies behind it, and who we share data with. Request what you need for your review and we'll send it over.
Compliance overview
Where our audits and commitments stand
SOC 2
Security trust services criteria
- SOC 2 Type IReport issued
Security criteria, examined by Zero Day CPA, PC, as of August 31, 2026. Report issued October 20, 2026.
- SOC 2 Type II observation periodUnderway
An auditor is testing our controls over time. The report follows the period.
- No training on your dataBy contract
Written into our DPA and our agreements with AI model providers.
Featured documents
The ones most reviews start with
SOC 2 Type I report
Information Security Policy
Security Incident Response Plan
Security program
61 controls in place across 9 areas
- Data encrypted in transit with TLS 1.2 or later
- Customer data encrypted at rest
- Connector credentials encrypted again at the application layer (AES-256-GCM)
- Each customer's data and agent workspace logically isolated
- AI model providers bound by zero data retention agreements
- Customer data never used to train models
- Cloud resources holding customer data block public access
- Customer data classified, retained and deleted by written policy
- All customer traffic passes a web application firewall and DDoS protection
- Network firewall rules managed as code
- Network configuration reviewed every year
- Infrastructure reachable by staff only over a private network
- Production databases have no public IP address
- Cloud infrastructure patched regularly
- Production secrets kept in Google Secret Manager
- Customers sign in through their own identity provider; we store no passwords
- Role-based permissions in every organization
- Only org admins can connect or change integrations
- Staff sign in with single sign-on and multi-factor authentication
- Unique accounts for every person; shared credentials in a password manager
- Access granted on least privilege with documented approval
- User access reviewed every quarter
- Access removed within 24 hours when someone leaves
- Each agent reaches only the tools on its allow-list
- Write actions can require a person's approval first
- Every agent run recorded step by step
- Per-run cost and turn limits
- Inbound messages can be screened for instructions aimed at an AI
- Every change reaches production through a pull request; direct pushes are blocked
- Policy changes approved by the co-founder who did not write them
- Automated tests and checks before code is merged
- Development and testing never use customer data
- Infrastructure changes go through the same pull request and deploy process
- Dependencies scanned for vulnerabilities on every change and on a schedule
- Vulnerabilities fixed on deadlines set by severity
- Secret scanning on every change
- Desktop app releases code signed
- The team is notified of every production deploy
- Automated daily database backups, the last 14 kept
- Point-in-time database recovery for the last 7 days
- Deleted or overwritten stored files recoverable for 7 days
- Backups encrypted, with access restricted
- Deletion protection on production databases
- Business continuity and disaster recovery plan, reviewed every year
- Infrastructure and edge activity logged and monitored
- Alerts go to the team and are tracked to resolution
- Written incident response plan, reviewed every year
- Incident response tested every year with a tabletop exercise
- A lessons-learned review after every incident
- Security issues can be reported to [email protected]
- Customers can view and export their own audit log
- Company laptops use disk encryption, anti-virus and strong passwords
- Device settings checked every quarter
- Background checks for employees and contractors
- Security training at hire and every year
- Security policies and code of conduct accepted at hire
- Security policies reviewed every year
- Yearly risk assessment, including fraud, with a risk register
- Security steering committee meets every quarter
- Vendors' security reports reviewed every year
- Cybersecurity insurance in place
Security review
Have a questionnaire or want to walk through it live?
We'll fill in your questionnaire and go through the architecture with your security team.