Skip to main content
OneStream Software logo

OneStream Software

Regulatory evidence

OneStream Software provides a revolutionary corporate performance management (CPM) solution that unifies and simplifies financial

onestream.comFinance and accountingLast verified 21 Sep 2026

OneStream Software against third-party requirements

For each regulation, how many of the requirements it places on your vendors OneStream Software’s public evidence reaches. Open one for every item with its date and source.

Documents on the trust centre

What the vendor lists, typed; public items can be read now, the rest are available on request.

18 documents listed on OneStream Software’s trust centre

trust.onestream.com
  • SOC 2 bridge letter
    • OneStream Bridge Letter for SOC 1 & SOC 2 - 8/31/2026on request · seen 21 Sep 2026
  • Business continuity and disaster recovery plan
    • BCP/DR/IR Summary Statement - 2025on request · seen 21 Sep 2026
  • ISO certificate
    • OneStream Software LLC - ISO 27018 Certificateon request · seen 21 Sep 2026
    • OneStream Software LLC - Manchester - ISO 27001:2022 - 2025-2028on request · seen 21 Sep 2026
  • Penetration test report
    • 2025 Platform Next-Gen Penetration Test Reporton request · seen 21 Sep 2026
    • 2025 Platform Penetration Test Report - OneStream v9.1on request · seen 21 Sep 2026
    • 2026 OneStream R1 VMSS Penetration Test Reporton request · seen 21 Sep 2026
  • Privacy policy
    • Cloud Privacy Policyon request · seen 21 Sep 2026
  • Security questionnaire (SIG, CAIQ, HECVAT)
    • 2025 OneStream CSA STAR Level 1 CAIQ v4.0.3public · seen 21 Sep 2026
    • OneStream Standard SIG 2026 Coreon request · seen 21 Sep 2026
  • Security policy or overview
    • Information Security Policyon request · seen 21 Sep 2026
  • SOC 1 report
    • OneStream 2025 Commercial & Government SOC 1 Type II - 09/30/25on request · seen 21 Sep 2026
    • OneStream 2026 Commercial & Government SOC 1 Type II - 03/31/26on request · seen 21 Sep 2026
    • OneStream 2026 Commercial & Government SOC 1 Type II - 06/30/26public · seen 21 Sep 2026
  • SOC 2 report
    • OneStream 2025 Commercial & Government SOC 2 Type II - 03/31/25on request · seen 21 Sep 2026
    • OneStream 2025 Commercial & Government SOC 2 Type II - 09/30/25on request · seen 21 Sep 2026
  • Accessibility conformance report (VPAT)
    • OneStream v9.1 VPATon request · seen 21 Sep 2026
    • OneStream v9.3 VPATon request · seen 21 Sep 2026

What the vendor says

Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.

  • Where data is hosted or processed

    Where can I find OneStream's Data Processing Terms?

    OneStream's Data Processing Terms can be found on OneStream's Commercial Terms and Conditions site here.

    as of 21 Sep 2026Source

  • Where data is hosted or processed

    Where are OneStream services geographically hosted?

    Data center locations for OneStream can be found here.

    as of 21 Sep 2026Source

  • Where data is hosted or processed

    Where are OneStream AI Services hosted?

    AI services made available to each customer are hosted in the data center agreed by the parties in their signed agreement.

    as of 21 Sep 2026Source

  • Encryption

    Does OneStream encrypt data at rest?

    Yes, all data within OneStream is encrypted using Advanced Encryption Standard 256-bit key encryption (AES-256).

    as of 21 Sep 2026Source

  • Encryption

    Does OneStream encrypt data in transit?

    Yes, all data in transit is sent using TLS 1.2+ everywhere data is transmitted.

    as of 21 Sep 2026Source

  • Use of customer data to train models

    Does OneStream use customer data to train its models?

    No, OneStream does not use customer data to train its models. OneStream maintains clear boundaries around data usage: - All customer data is stored within a dedicated customer instance that is logically separated. - For non-generative AI solutions, OneStream trains specialized models specifically for customer implementation using only customer data. - For generative AI offerings, OneStream leverages pre-trained mo...

    as of 21 Sep 2026Source

  • Penetration testing

    Does OneStream conduct penetration tests?

    OneStream engages an independent 3rd party to perform regular penetration testing against a "like customer" environment. An executive summary of Penetration Test results is made available to customers via OneStream's Solution Exchange.

    as of 21 Sep 2026Source

All articles

This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.