We publish only what we can back with evidence. Statements in earlier versions of our trust documentation that we can't currently evidence have been withdrawn and shouldn't be relied on. Today we do not claim:
- Verified cross-tenant isolation. We do not claim an independent isolation test or that cross-tenant access is proven prevented.
- That every administrative action is audit-logged.
- A specific number of active threat-detection rules, or MITRE ATT&CK coverage figures.
- An annual third-party penetration test.
- That all keys have moved off Azure Key Vault. Keys that stay in Azure Key Vault stay there by design. See Hosting and key management.
- Specific statements about how THEO, our AI assistant, processes or uses customer data, including for AI training. Earlier statements on this topic have been withdrawn.
- Compliance certifications, attestations, or compliance status, for example SOC 2, ISO 27001, PCI DSS validation, HIPAA compliance, or GDPR/CCPA compliance.
- PSA ticket attachment malware scanning, file-hash reputation checks, or that attachments were “scanned clean.” Harmful attachment types may still be blocked; that is not a malware verdict.
When we can evidence one of these, we'll update this page and the article it relates to.
Service status is published at status.theonestack.com.
This article describes The One Stack's practices as of the "last reviewed" date below. It is provided for general information only. It is not a contract, warranty, certification, or guarantee of any security outcome, and it does not change the terms of any agreement between you and The One Stack. Our practices may change over time. Last reviewed: 2026-10-28.