Security your clients can count on

OneFirmOS runs entirely on Amazon Web Services. Application compute runs on Amazon ECS Fargate, the database on managed Amazon RDS for PostgreSQL, and documents in Amazon S3 — all inside a private virtual network (VPC). The database is not publicly accessible; only the application can reach it. Public traffic enters through an application load balancer that redirects all HTTP to HTTPS.

In transit, all connections use modern TLS (1.3). At rest, the database and document storage are encrypted with AES-256, and the most sensitive fields carry an additional layer of application-level encryption. Encryption keys are managed by AWS Key Management Service (KMS).

Databases and internal services run in private subnets with security groups that permit only the traffic they need. The only public entry point is the HTTPS load balancer — there is no direct public access to the database or file storage.

Amazon RDS takes automated, encrypted backups daily and supports point-in-time restore; snapshots inherit the same AES-256 encryption as the live database. Documents in S3 are durably stored across multiple facilities. Formal recovery-time and recovery-point objectives (RTO/RPO) are on our roadmap.

Application secrets, database credentials and third-party tokens live in AWS Secrets Manager — never in source code or container images. Deployments authenticate to AWS with short-lived, federated credentials (OIDC), so there are no long-lived cloud keys to leak. Access to production follows least-privilege principles.

Passwords are salted and hashed; sessions use signed tokens scoped to the user and their firm. Within a firm, access is governed by granular role-based permissions, so each team member sees only what their role allows. Multi-factor authentication is supported for stronger sign-in protection.

OneFirmOS is multi-tenant with isolation enforced at the database using PostgreSQL row-level security. The signed-in firm is pinned on every database connection and every query is automatically scoped to that firm — so one firm's data can never be returned to another. This isolation is covered by automated tests.

Changes ship through an automated CI/CD pipeline into a staging environment that mirrors production before release. Infrastructure is defined as code and version-controlled, and releases are rolled out in a controlled way. Independent third-party penetration testing is on our roadmap.

Administrative and platform actions — sign-ins, firm and plan changes, configuration changes, data exports and impersonation — are recorded in an activity log. Every proposal e-signature captures a tamper-evident audit trail (IP address, device, timestamp and a document hash) with a downloadable signing certificate.

Firms can configure retention periods, apply legal holds, and have records automatically purged when retention lapses; storage limits are enforced per firm. Firms can export their data at any time, and data is deleted after termination in line with the agreement.

The platform runs on managed, health-checked AWS services with controlled, rolling deployments to minimize disruption. A public status page and a formal uptime commitment (SLA) are on our roadmap.

Our practices align with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and with Quebec's Law 25 where we serve Quebec firms or their clients. Our privacy policy is published and kept current, and data residency follows each client's location (Canada or US).

For the client data firms store in OneFirmOS, we act as a service provider processing it on the firm's instructions, governed by a Data Processing Agreement. We rely on a limited set of vetted subprocessors — AWS (hosting), Stripe (payments), SendGrid (email), our AI providers, and Microsoft/Google for optional connected mailboxes — under contracts requiring a comparable level of protection.

Firms own their data. We provide tools to access, correct, export and delete personal information so firms can meet access and correction requests, and we assist with data-subject and regulator inquiries. On termination, firms can export their data before it is deleted.

We do not currently hold a formal certification; a SOC 2 Type II examination is on our roadmap. We're glad to share our security documentation — including our Security & Privacy Schedule and Data Processing Agreement — for your review. Email support@onefirmos.com.