Your portfolio data secure, entirely within the EU
Information security is the foundation of everything we build. Here you can read how Onesurance protects your data and which agreements apply.
- Storage, processing and access exclusively within the European Union.
- Onesurance is the processor; you remain the data controller.
- No general model training on your data, unless you agree otherwise in the data processing agreement.
Three principles guide every security decision
We take a risk-based approach: we continuously identify, assess and treat security risks.
Confidentiality
Access controls, encryption and monitoring protect sensitive and personal information against unauthorised access.
Integrity
Systematic checks and validation keep information accurate, complete and unaltered.
Availability
Redundant infrastructure, business continuity planning and proactive monitoring keep the service available.
Where we stand, per framework
| Framework | Status | Details |
|---|---|---|
| AVG / GDPR | Compliant | Full compliance since inception; Data Protection Officer appointed. |
| ISO 27001 | In progress | ISMS operational; certification audit planned for Q1 2027. Last internal audit: September 2026. |
| DORA | Aligning | Control measures set up around the five DORA pillars. |
| EU AI Act | In preparation | AI applications classified as Limited / Minimal Risk; developments are being monitored. |
| NIST CSF | Guideline | Core controls implemented; continuous improvement. |
| CIS Controls | Guideline | Top 10 critical controls active; periodic evaluation. |
Details per framework: Compliance overview →
Everything about security and privacy, by topic
Data Security
Encryption, access control and monitoring.
Read more →Privacy
Roles, data types and data subject rights.
Read more →Infrastructure
Azure architecture within the EU.
Read more →Sub-processors
Who processes data, and under which agreements.
Read more →Incident Response
From detection to closure, with notification within 24 hours.
Read more →Business Continuity
Backups, recovery times and disaster recovery.
Read more →Compliance
GDPR, ISO 27001, DORA and the EU AI Act.
Read more →Certifications
Status, audits and planning.
Read more →Questions about security, compliance or privacy?
Our Data Protection Officer is happy to answer them.