Software for the work that cannot fail quietly.
OnePointe holds some of the most sensitive records in higher education — Title IX investigations, student conduct files, BIT/CARE referrals. Our security program is built so that protecting that data is not an afterthought, a compliance checkbox, or a marketing claim. It's the foundation everything else stands on.
Encrypted at every layer, with your keys.
Every byte of case data is encrypted in transit and at rest. We support customer-managed encryption keys for institutions that want full key custody, including the ability to revoke OnePointe's access at any time.
-
Encryption in transit
TLS 1.3 with strong cipher suites only. HSTS preload enabled. Certificate pinning supported for institutional networks. No legacy protocols accepted.
TLS 1.3 · AES-256-GCM · X25519 KEX · ECDSA P-256 -
Encryption at rest
AES-256 envelope encryption for all stored data, including database records, document attachments, and audit logs. Per-tenant data encryption keys, rotated quarterly. Backup encryption uses separate key hierarchy.
AES-256-GCM · AWS KMS · Quarterly rotation -
Customer-managed keys (BYOK)
Institutions on Enterprise plans can provide their own KMS keys. OnePointe operations cannot decrypt your data without your active key authorization. You retain full revocation control.
-
Field-level encryption
Highly sensitive fields — names, identifiers, free-text narratives — are individually encrypted with separate keys, so a compromised database snapshot reveals only structure, not content.
Least privilege, by default.
Role-based access control enforced down to the field level. Every user, every action, every record. SSO is the standard, not a premium feature.
-
Single Sign-On
SAML 2.0 and OpenID Connect supported on all plans. Native integrations with Okta, Microsoft Entra ID, Google Workspace, and Shibboleth.
SAML 2.0 · OIDC · SCIM 2.0 -
Multi-factor authentication
Required for all administrators. Configurable MFA policies for end users. WebAuthn / FIDO2 hardware keys, TOTP, and push-based options supported.
-
Granular permissions
Eight built-in roles with clear capability boundaries. Custom roles available for institutions with bespoke org structures. Permission inheritance is explicit and auditable.
-
Session management
Configurable session timeout (default 30 minutes idle, 8 hours absolute). Concurrent session limits. IP allowlisting available. Forced sign-out on permission change.
Every change, by whom, when, and why.
Audit logs are immutable, exportable, and retained for the full lifetime of the case. They have held up under OCR review, internal investigations, and litigation discovery. They will hold up for you too.
-
Field-level audit trail
Every read, every edit, every export — captured with user, timestamp, IP address, and reason code where applicable. No retroactive edits to the audit log itself; corrections are appended, never overwritten.
-
Real-time SIEM integration
Stream audit events to your existing SIEM (Splunk, Sentinel, Datadog, Sumo Logic) via webhook or syslog. Available on Enterprise plans.
-
Anomaly detection
Automated alerts for unusual access patterns: bulk exports, off-hours access, unusual geographic locations, repeated failed sign-ins. Configurable thresholds per institution.
-
Retention & legal hold
Configurable retention policies aligned to FERPA, Title IX, and state mandates. Legal hold suspends all retention rules for selected records. Defensible deletion with cryptographic shredding.
Hosted in the U.S. Period.
OnePointe runs on AWS in U.S. regions only. Data never crosses a border. Multi-AZ deployment with automated failover. Quarterly disaster recovery exercises with documented results.
-
Hosting region
Primary: AWS us-east-1 (Northern Virginia). Failover: us-west-2 (Oregon). FedRAMP-eligible regions available for institutions with federal contracts.
AWS · GovCloud option · ITAR not in scope -
Availability
99.95% uptime SLA on Enterprise plans. Status page at status.onepointe.ai with real-time component health and historical incidents.
-
Backups & recovery
Encrypted backups every 15 minutes, retained 90 days. Point-in-time recovery to any second within 35 days. RPO under 5 minutes; RTO under 1 hour.
-
Tenant isolation
Logical isolation by default with per-tenant encryption keys. Dedicated single-tenant deployments available on Enterprise plans for institutions with strict isolation requirements.
Proactive, not reactive.
Independent penetration testing twice a year. Continuous dependency scanning. A bug bounty program with clear scope and quick payout. Disclosed vulnerabilities published in a public changelog.
-
Penetration testing
Independent third-party penetration tests every six months by NCC Group. Latest report available under NDA via your account manager.
-
Dependency & SAST scanning
All dependencies scanned daily. Static analysis runs on every pull request. Critical vulnerabilities patched within 24 hours; high within 7 days.
-
Responsible disclosure
Active bug bounty program at onepointe.ai/security. Acknowledged within 24 hours; payouts up to $25,000 for critical findings.
-
Security changelog
Every security-relevant change is published to a public changelog with CVSS scoring, affected components, and remediation steps. Subscribe via RSS or email.
If something goes wrong, you'll know first.
We notify affected institutions of any confirmed security incident within 24 hours, even when not legally required. We share what happened, what we know, what we don't, and what we're doing about it. No spin.
-
24-hour notification commitment
Contractual notification within 24 hours of incident confirmation, including a preliminary impact assessment and our response timeline. State-specific breach notification handled in parallel.
-
Dedicated incident channel
Each institution has a designated incident contact and a private Slack/Teams channel for real-time coordination during active events.
-
Post-incident reports
Public post-mortems for any incident affecting more than one institution, published within 14 days. Root cause analysis, contributing factors, and corrective actions all documented.
Want the full security packet?
SOC 2 Type II report, FERPA addendum, DPA, penetration test summary, business continuity plan, and a one-page summary you can hand to your CIO. Available under NDA.