Trust Center
What we actually have in place, stated plainly.
OneAI Labs is built on the principle that evidence beats claims. This page applies that same standard to ourselves — including the parts that aren't done yet.
Security
- Cloud access uses workload identity (OIDC/STS/managed identity) rather than static, long-lived credentials.
- API keys are scoped per customer and per environment, and can be issued, rotated or revoked independently.
- Approval tokens are held in memory only and cleared on reload — never persisted to disk.
- Enterprise SSO, fine-grained RBAC and policy-as-code are on the roadmap and not yet generally available.
AI Governance
- A production release requires independent evaluation against an immutable baseline before it can promote.
- Dual-principal approval is an invariant, not a setting: the requester can never approve their own promotion.
- Releases move through shadow and staged canary traffic before full production, with health-aware rollback.
- Every run produces an append-only audit record — see real figures on the Evidence page.
Data
- Tenant-scoped data isolation is enforced at the database layer, not only in application logic.
- Website contact-form data is processed under our published Privacy Policy, in line with Malaysia's PDPA.
- Retention, access and deletion rights for personal data are detailed in the Privacy Policy, not summarized here.
Reliability
- Rollback is a proven, exercised capability — see the real rollback count on the Evidence page, not a promise.
- High-availability and disaster-recovery code exists; a 30-day observed SLO has not yet been accepted as evidence.
- A public status page is planned and not yet live — we would rather have none than one that isn't backed by real monitoring.
Legal
- ONEAI LABS SDN. BHD. (registration no. 202601020394 (1682491-W)), incorporated in Malaysia on 18 May 2026.
- Privacy Policy and Terms of Use are published and linked in the site footer.
- Legal and security questions: info@oneailabs.ai.
Compliance
- SOC 2: not currently certified.
- ISO 27001: not currently certified.
- Formal certification has not been pursued yet. The underlying practices — audit trails, approval gates, tenant isolation, reversibility — are built into the product today; the paperwork is not.
Build for production
Your AI should not stop at a demo.
Route intelligence through Core, govern it with TheOne, persist the work in OneMission, execute through OneClaw and keep verified outcomes in OneField.