How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
OneStream Software
GDPR evidence
OneStream Software provides a revolutionary corporate performance management (CPM) solution that unifies and simplifies financial
Vendor-statedOneStream Software and GDPR
OneStream Software states it holds a data processing agreement. CertReports captured this on 21 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 21 Sep 2026 · confidence 90%VerifiedActive: SW-US Certification, EU-US Certification, UK Extension Certification
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 24 Mar 2017
- Expires or valid through
- 20 Feb 2027
- Scope
- HR Data: OneStream Software LLC processes Personal Data of its affiliates’ employees for HR purposes, with OneStream Software acting as a controller. Personal data can be collected by OneStream as part of recruitment and on-boarding and on an ongoing basis as required to meet our responsibilities as an employer. Personal data can also be collected through use of third-party services, including without limitation, payroll, tax authorities, travel booking and expense claims. Examples include Personal contact details, salary, tax code, employment history and provision of employee benefits. Applicable Personal data may be shared with our suppliers, employment benefit providers and customers. It may also be disclosed in response to a lawful request by public authorities to meet national security or law enforcement requirements, in accordance with Applicable Data Protection Laws. Non HR Data: OneStream Software LLC makes available an enterprise finance software as a service (“Saas”) hosted by or on behalf of OneStream with the typical use case being the processing of non-public financial data. Personal Data of OneStream Software’s customers is processed for the purposes of delivering the SaaS service and meeting contractual obligations, with OneStream Software acting as a processor. OneStream Software processes some Personal Data of its customers for billing and compliance purposes, with OneStream Software acting as a controller. The customer determines the Data Subjects whose Personal Data will be processed. The following types of Data Subjects will be covered: • Persons who use the hosting services and software as a part of their work for Customer. • Persons who are the source of, or the responsible person associated with, data that Customer provides as part of its use of the software. The customer determines the categories of Personal Data that will be processed. The following categories of Personal Data will be covered: • Names and business contact details such as work email address, office address, telephone number and job title • Employee ID number or other account numbers It should be noted that for customers using the People Planning module, sensitive or special category personal data may also be processed such as personal data relating to employee benefits, tax and payroll information and ethnic background. Processing operations include, the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure and destruction for the duration of processing identified above. Customer Personal data is not disclosed to third parties. Please see our sub processors available here Sub-processors List.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | OneStream Software LLC: Active: SW-US Certification, EU-US Certification, UK Extension Certification | Live pagesha256 332a253b8e |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is OneStream Software GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 22 Sep 2026AI training policy changedTraining on customer data moved from unknown to no.
- 18 Sep 2026Subprocessor added: Amazon Web Services, Inc. and its affiliatesAmazon Web Services, Inc. and its affiliates appeared on the subprocessor list.
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: Microsoft Corporation and its affiliatesMicrosoft Corporation and its affiliates appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Okta Inc. and its affiliatesOkta Inc. and its affiliates appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: OneStream’s Affiliates, including OneStream Software LLC, OneStream Software Ltd, OneStream Software Pty Ltd, and OneStream Software BVOneStream’s Affiliates, including OneStream Software LLC, OneStream Software Ltd, OneStream Software Pty Ltd, and OneStream Software BV appeared on the subprocessor list.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Finance and accounting category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Abacum
Finance and accounting
The AI-native FP&A platform that helps Finance teams drive business…
Tesorio
Finance and accounting
Tesorio is the cash flow performance platform that helps finance…
HIghRadius
Finance and accounting
World's #1 Autonomous Finance Platform to lower DSO, optimize working capital, fast-track financial close and improve
LiveFlow
Finance and accounting
The Unified AI-ERP & FP&A Platform
Understand GDPR evidence
All articlesExplainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read