Security controls for sensitive vendor data
OnComply handles sensitive vendor data: ACH details, tax IDs, insurance information, and signed contracts. The security architecture reflects that.
Your data is encrypted at every layer
Sensitive vendor data is encrypted in transit and at rest, and the most sensitive fields receive an additional layer of application-level encryption before they ever reach the database.
Extra protection for sensitive data
Bank account details and tax IDs are encrypted with AES-256 before being stored, the same standard used by banks and government agencies. Even with direct database access, those values are unreadable.
Tenant-scoped encryption
Sensitive data is protected with tenant-scoped envelope encryption backed by AWS KMS. Encryption context prevents encrypted values from being decrypted outside the organization they belong to.
Record-bound encryption
Encrypted values are cryptographically bound to the record they belong to. If an encrypted value were copied to a different record, decryption would fail automatically.
Encryption in transit
All public traffic is served over HTTPS, and plain HTTP requests are redirected to secure connections. Connections to our database and cache are encrypted as well.
Encrypted document storage
Every uploaded document is encrypted at rest with managed encryption keys, and files processed through our document pipeline are verified for file type and integrity.
Your data is isolated at the database level
Tenant isolation is enforced by the database engine, not only by application code. Row-level security policies block cross-tenant reads even if an application-layer check is wrong.
Database-enforced tenant isolation
Every tenant-scoped table is protected by database row-level security policies, so the database engine itself enforces isolation between organizations. That coverage is verified automatically in our CI pipeline.
Granular role-based access
Five distinct admin roles let you control exactly who can do what: Owner, Admin, Ops, Finance, and Auditor. Each role has carefully scoped permissions, and access to full payment details is limited to designated privileged roles.
Step-up authentication for sensitive actions
High-risk operations, like viewing full bank account details or downloading sensitive exports, require re-entering your password even if you're already signed in, and that elevated access expires after a short window.
Scoped API keys
API keys are limited to specific permissions when created. A key built for single-vendor lookups can't be used to run bulk queries. Keys are securely hashed before storage.
Controlled support access
Ticket-based support sessions require approval from your team and are strictly time-limited. Separately, platform setup access, which OnComply staff use for implementation work during onboarding, is enabled by default and can be turned off at any time from your settings. Every support and setup session is time-limited, re-validated on each request, and recorded in your audit log with the operator's identity and the reason for access.
Multiple layers of identity verification
Admin users, vendor portal users, and API integrations each have their own authentication method, designed for how they're actually used.
Managed identity provider
Admin authentication is handled by a dedicated managed identity service, and every request is cryptographically verified.
Multi-factor authentication
MFA is required by default for privileged roles, including Owner and Finance, and can be enforced for any admin user. Verification codes are time-limited and attempt-limited to prevent brute-force attacks.
Session security
Sessions are short-lived and cryptographically tied to your current credentials. Changing your password revokes active sessions and refresh tokens across your devices.
Vendor portal security
Vendor portal access uses expiring, vendor-scoped tokens that are validated against the database on every request, checking status, expiration, and permissions. Only one active portal link exists at a time.
Strong password requirements
Passwords must be at least 12 characters with uppercase, lowercase, numbers, and symbols, and recently used passwords can't be reused.
Brute-force protection
Authentication endpoints are rate-limited. Repeated failed attempts trigger escalating delays and are logged and flagged for review.
Defense in depth across the entire platform
Modern security headers, parameterized queries, and layered validation applied consistently across the platform.
Hardened Content Security Policy
Application pages are served with a strict Content Security Policy using nonce-based script execution, and we continue to tighten the policy over time.
Industry-standard security headers
Responses carry a full suite of security headers: HTTPS enforcement, clickjacking protection, content type enforcement, and restricted browser permissions for camera, microphone, and location.
Webhook validation
Webhook destinations are validated against private and internal address ranges before every delivery attempt, including resolving DNS and pinning the verified addresses, to prevent server-side request forgery (SSRF).
SQL injection prevention
Every user-supplied value is passed to the database as a bound parameter, never interpolated into query text.
Secrets management
No credentials live in application code. Configuration is validated at startup, and production deployments refuse to boot with missing or placeholder secrets.
Cloud-native, isolated by design
OnComply's backend runs on enterprise-grade cloud infrastructure with strict separation between public traffic, application logic, and data storage.
Hardened container workloads
Application services run in managed container orchestration as non-root containers with locked-down permissions and enforced resource limits.
Private network architecture
Databases and caches live in private subnets with no route to the internet. Public traffic enters through a managed load balancer that redirects everything to HTTPS.
Resilient managed database
The database runs on a managed PostgreSQL service with Multi-AZ high availability, automated backups, and point-in-time recovery.
Managed keys and secrets
Encryption keys are managed through AWS KMS with rotation enabled and key usage logged. Application secrets live in a managed secrets service and are injected at runtime, never baked into container images.
A detailed record of what matters
Significant actions in OnComply are recorded in a protected audit log designed to support compliance reviews and investigations.
Tamper-resistant audit log
Audit records are protected by database-level constraints that block modification once written, giving you a reliable record for compliance reviews and investigations.
Long-term retention
Audit logs are retained for seven years by default, organized in time-based partitions for reliable long-term storage.
Broad event coverage
Key actions are recorded: vendor status changes, document validation decisions, contract signings, payment submissions, exports, failed sign-in attempts, administrative changes, and more.
Detailed context for every event
Audit entries capture who performed the action, what was affected, the type of action, and relevant metadata, including the originating IP address where available.
Vendor compliance timeline
Each vendor gets a single chronological timeline combining status changes, document events, contract activity, and communications, so you have a clean view of every vendor's compliance journey.
Exportable audit trail
Export audit history for your organization or any single vendor at any time. Audit exports are themselves recorded, so you always know who accessed what.
AI processing transparency
Sensitive document processing is disclosed up front
Microsoft Azure processes documents for automated extraction and validation. Our public DPA overview explains what Azure receives, the redaction boundary, Microsoft's no-training terms, limited operational retention, abuse monitoring, and the process for requesting an AI processing restriction before production use.
Responsible Disclosure
If you discover a security vulnerability in OnComply, please report it to us at support@oncomply.biz. We will acknowledge your report within 24 hours and work with you to understand and address the issue. We do not pursue legal action against researchers acting in good faith.
Please include a description of the vulnerability, steps to reproduce, potential impact, and any suggested remediation. We will keep you informed throughout the investigation.