We treat your merchant portfolio and the results OneRisk produces for it as confidential customer data.
Logical separation
Customer data is logically separated, with tenant-level access controls enforced throughout the application.
Encryption in transit
Data exchanged with the OneRisk application and API is encrypted in transit.
Encryption at rest
Customer data is encrypted at rest across our databases, caches and object storage.
Data minimization
OneRisk requires only a merchant’s website address to run a scan. All other information is optional.
Infrastructure
The OneRisk platform is hosted on Amazon Web Services (AWS).
Physical security
Our infrastructure runs in AWS data centers, which are protected by rigorous physical and environmental controls.
Web application firewall
Inbound traffic is filtered by a web application firewall with managed protection rules and rate limiting.
Network security
Databases are isolated from the public internet, and network access between services is limited to what each one requires.
Access control
Access to OneRisk is authenticated and controlled, for your team and for ours.
Multi-factor authentication
Users can secure their accounts with multi-factor authentication, using passkeys, authenticator apps or one-time codes.
Role-based permissions
Administrators decide who in their organization can access OneRisk and who can manage users and settings.
Credential protection
Passwords and API keys are stored only as one-way hashes, never in plain text.
Session security
Sessions expire automatically, and sign-in attempts are rate-limited to deter brute-force guessing.
Workforce access
OneRisk staff access our cloud environment through centralized single sign-on.
Monitoring and logging
We monitor the platform continuously and maintain audit records of activity across it.
Continuous monitoring
Production systems are monitored around the clock, with automated alerting to our engineering team.
Cloud audit trail
Activity across our cloud environment is recorded to a separate, access-restricted log archive.
Application audit log
Administrative actions within the platform are captured in an audit log.
Secure development
Security is built into how we develop and release OneRisk.
Controlled releases
All code is managed in version control and released through an automated build and deployment pipeline.
Dependency management
Third-party software is tightly managed, so every release is built from known versions.
Secrets management
Application secrets are held in a managed secrets store rather than in source code.
Least privilege
Application services run in containers without administrative privileges.
Business continuity
OneRisk is designed to protect your data from hardware failure and accidental loss.
Database redundancy
The production database is replicated across physically separate data centers.
Backups
Database backups are continuous and encrypted, with point-in-time recovery throughout the retention period.
Vulnerability disclosure
We value the work of the security research community. If you believe you have found a vulnerability in
OneRisk, please report it to info@onerisk.com with a description of the issue and the steps
to reproduce it. When testing, please:
Test only against accounts and data you own.
Do not access, modify or delete data that belongs to others.
Avoid any testing that could degrade the service, including denial of service and high-volume automated scanning.
Allow us a reasonable period to resolve the issue before disclosing it publicly.
See what we see.
We see virtually every active online merchant. Let us show you how that protects your portfolio.
