Legal
Security
Last updated: August 2026
Interim pilot security
ONCE is offered through a controlled, invitation-only pilot. This page describes ONCE's interim security posture during the pilot. Specific security, privacy, encryption, retention, and data-processing commitments are governed only by an executed agreement between your firm and ONCE.
Access controls
ONCE's product and demonstration pages are public. The current operational workspace is restricted to administrators while access controls for external firms are completed. A login or an invitation does not create a separate firm environment. External firm access will be enabled only after workspace provisioning and data isolation have been validated.
Demonstration workspaces
Demonstration workspaces use synthetic, fictional data. Do not upload protected health information or confidential client information into a demonstration workspace.
What we do not claim
During the pilot, ONCE does not represent or warrant HIPAA compliance, SOC 2 certification, an executed BAA, specific encryption standards, specific data-retention guarantees, or any enterprise security certification. We will not make these claims unless they are documented, operationally true, and independently verified.
Responsible disclosure
If you believe you have identified a security issue, please contact your ONCE pilot lead immediately so we can investigate.