Stay Ahead of Risk

Overview

Security and compliance aren't checkboxes, they're woven into every layer of how OneSupport, Inc. operates. From end-to-end encryption and multi-factor authentication to strict access controls, we ensure your data and systems are always protected. Our solutions are built to meet the highest regulatory standards, including HIPAA, PCI DSS, and SOC 2, so you can focus on your business knowing your infrastructure is secure, compliant, and ready for whatever comes next.

OneSupport's security model is not reactive, it's structural. Our infrastructure and operations are purpose-built to meet the most rigorous regulatory requirements across healthcare, finance, government, and enterprise environments. Every layer of our platform is independently hardened, continuously monitored, and aligned to the compliance frameworks your industry requires. A gap at one level never creates exposure at another.

Regulatory Frameworks

Our platform and operating model are certified and audited against the frameworks that matter most to your organization and the regulators you answer to. Each certification is maintained through continuous monitoring, not point-in-time snapshots.

HIPAA

OneSupport is fully HIPAA compliant, providing protected health information (PHI) safeguards across all customer-facing and internal systems. Our infrastructure supports covered entities and business associates under HIPAA by enforcing strict data handling policies, audit logging, and access controls.

PHI Handling

All PHI is encrypted in transit and at rest. Access is restricted to authorized personnel under role-based controls, with full audit trails maintained for all access events. We sign Business Associate Agreements (BAAs) with all applicable clients prior to any PHI being transmitted.

Continuous Audit Readiness

Our HIPAA controls are not annual snapshots. Policy enforcement engines and automated auditing tools continuously validate the environment against HIPAA's required safeguards, generating compliance evidence on demand for audit submissions.

SOC 2

Our SOC 2 Type II certification covers the AICPA Trust Services Criteria for Security, Availability, Confidentiality, and Processing Integrity. Annual third-party audits validate continuous operational compliance, not just a point-in-time snapshot.

Scope of Coverage

• Security — logical and physical access controls, change management, risk mitigation.
• Availability — system uptime, incident response, business continuity.
• Confidentiality — data classification, encryption, access restriction.
• Processing Integrity — complete, valid, accurate, timely processing.

SSAE 16

OneSupport holds SSAE 16 accreditation for its email security, archiving, and continuity services. SSAE 16 (Statement on Standards for Attestation Engagements No. 16) is the authoritative standard for reporting on service organizations' controls.

Our SSAE 16-accredited email infrastructure provides 24/7 availability with intelligent threat filtering, real-time protection against advanced email-borne risks, and compliant archiving for regulatory retention requirements.

Coverage Areas

• Inbound and outbound email security filtering.
• Email continuity and failover during outages.
• Compliant email archiving with configurable retention policies.
• Advanced threat protection including zero-day and phishing defense.

Encryption & FIPS 140-2

All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256. OneSupport uses FIPS 140-2 validated cryptographic modules, the standard required by U.S. federal agencies, government contractors, and highly regulated industries globally.

FIPS 140-2 Validated Modules

FIPS 140-2 is the U.S. government standard for cryptographic modules. Our use of FIPS-compliant OpenSSL modules ensures that every cryptographic operation, key generation, encryption, decryption, hashing, meets the federally mandated security requirements for protecting sensitive unclassified information.

ECDH Key Agreement

OneSupport uses Elliptic Curve Diffie-Hellman (ECDH) key agreement to establish session keys for all encrypted communications. ECDH provides forward secrecy, meaning that even if a long-term private key is compromised in the future, past session traffic cannot be retroactively decrypted.

Why Forward Secrecy Matters

In traditional RSA key exchange, session keys are encrypted using the server's long-term public key. If that key is later compromised, all recorded past sessions can be decrypted. ECDH eliminates this risk by generating a unique, ephemeral key pair for every session that is discarded after use and never stored.

• Session keys are generated per-connection and destroyed after session termination.
• Compromise of long-term keys does not expose past communications.
• Meets forward secrecy requirements under NIST SP 800-52 and PCI DSS.
• Interception-resistant across untrusted network segments.

Access Control & Two-Factor Authentication

Access to all systems and customer data is governed by least-privilege role-based access control (RBAC). Technician and administrator accounts are provisioned on a need-to-know basis with full audit logging of all access events.

MFA Requirements

Multi-factor authentication (MFA) is mandatory for all internal systems. TOTP-based 2FA is enforced for all privileged accounts. Sessions are time-limited and automatically terminated on inactivity.

Privileged Access

Administrative access to production systems requires approval workflows, just-in-time access provisioning, and is logged in immutable audit trails retained per applicable compliance requirements.

Security Architecture

OneSupport's security model is built in independent layers. Each layer is hardened and monitored separately, so a failure at one level does not cascade into exposure at another. The six layers of our security stack are:

Capabilities

Every capability below is active, monitored, and available across all OneSupport client environments. Nothing here is optional or add-on, it is the baseline of how we operate.

Monitoring & Incident Response

OneSupport operates a continuous security monitoring program covering all production systems, endpoints, and network segments. Automated alerting thresholds are tuned to detect behavioral anomalies, unusual access patterns, and potential indicator-of-compromise events in real time.

Incident Response Protocol

In the event of a confirmed or suspected security incident, OneSupport follows a documented incident response plan aligned to NIST SP 800-61. The five stages of our IR protocol are:

1. 01Preparation — Maintained runbooks, trained responders, and tested playbooks for common incident types.
2. 02Detection & Analysis — Automated SIEM alerts with 24/7 analyst review and severity classification.
3. 03Containment — Immediate isolation of affected systems to prevent lateral movement.
4. 04Eradication & Recovery — Root cause elimination, clean restoration, and integrity verification before service resumption.
5. 05Post-Incident Review — Written findings and remediation commitments shared with affected clients within agreed SLA windows.

Clients are notified of incidents affecting their environments within the timeframes required by applicable law and as defined in their executed service agreement.

Data Handling

OneSupport handles customer data with the same standards applied to its own most sensitive internal information. Data classification, retention, and destruction policies are enforced programmatically, not relying solely on manual process adherence.

Data Classification

• Public — Information approved for unrestricted external distribution.
• Internal — Business information for authorized internal use only.
• Confidential — Customer data, financial records, and operational data requiring protection.
• Restricted — PHI, PCI data, credentials, and regulated data under strict controls.

Retention & Destruction

Customer data is retained for the duration of the service relationship and for any period required by applicable law or the executed service agreement. Upon contract termination, data is made available for client export for thirty (30) days, after which it is destroyed using NIST 800-88-compliant methods.

Regulated Environments

Customers operating under HIPAA, PCI DSS, or federal contracting requirements should execute a Data Processing Agreement (DPA) or Business Associate Agreement (BAA) with OneSupport prior to transmitting regulated data. Contact your account representative for details.

Contact Information

For questions about our security posture, compliance certifications, or to request audit documentation, including SOC 2 reports, BAAs, or DPAs, please contact our Security & Compliance team.