Legal
Security
Last updated: August 2026
Interim pilot security
ONCE is offered through a controlled, invitation-only pilot. This page describes ONCE's interim security posture during the pilot. Specific security, privacy, encryption, retention, and data-processing commitments are governed only by an executed agreement between your firm and ONCE.
Access controls
Access to ONCE is invitation-only. Public self-registration is disabled. Accounts are provisioned by ONCE administrators. Role-based permissions restrict access to administrative, founder, and configuration areas.
Demonstration workspaces
Demonstration workspaces use synthetic, fictional data. Do not upload protected health information or confidential client information into a demonstration workspace.
What we do not claim
During the pilot, ONCE does not represent or warrant HIPAA compliance, SOC 2 certification, an executed BAA, specific encryption standards, specific data-retention guarantees, or any enterprise security certification. We will not make these claims unless they are documented, operationally true, and independently verified.
Responsible disclosure
If you believe you have identified a security issue, please contact your ONCE pilot lead immediately so we can investigate.