Encryption in transit
All API, dashboard and webhook traffic is served over HTTPS.
Trust Center
Trust is a receipt,
not a promise.
OneShot has completed its SOC 2 Type II audit. OneShot is GDPR compliant. Your agents send real data through OneShot: messages, contacts, payments. Here is how we protect it, who processes it, and how to verify what happened yourself.
- Subprocessors
- 32
- Receipts
- Ed25519
- Spend limits
- Before execution
- Secrets
- Never in code
01
Data protection
How data is protected in transit, at rest and in our own systems.
Encryption at rest
Databases and file storage are encrypted at rest by Google Cloud. Sensitive fields, such as agent profile data and access tokens, are also encrypted with Cloud KMS keys.
Secrets management
Provider credentials and signing keys live in Google Secret Manager and are injected at runtime, never stored in code.
SOC 2 Type II
OneShot has completed its SOC 2 Type II audit. Request the report through our compliance portal.
GDPR
OneShot is GDPR compliant.
02
Access and authentication
How API access is issued and protected.
API keys
API keys are stored only as hashes. We cannot read a key after it is issued.
Brute-force protection
Repeated failed authentication attempts trigger escalating lockouts.
Least privilege
The OneShot API and worker each run as their own service account, limited to the queues, keys, buckets and secrets they use.
03
Spend and integrity
Controls on what agents can spend and proof of what they did.
Spending limits
Daily and per-transaction limits are enforced before a paid action runs.
Signed receipts
Every paid action returns an Ed25519-signed receipt you can verify offline with our public key.
Isolated execution
Agent code runs in isolated, short-lived sandboxes, separate from OneShot infrastructure.
Verify it yourself
Don't trust the log. Check the signature.
Every paid action returns a receipt signed with Ed25519. Verify it offline with our public key, using the SDK's verifyReceipt() or the oneshot-verify-receipt CLI. No call to us required.
Subprocessors
Who processes data on our behalf.
The providers OneShot sends customer data to, and what for. We update this list before a new provider goes live.
Analytics
- PostHog
Product analytics for the API and dashboard.
Cloud monitoring
- LangSmith
Tracing of model calls for debugging and quality.
Cloud provider
- Google Cloud Platform
Hosting, databases, queues, storage and key management for the OneShot API and workers.
- Vercel
Hosting and domains for sites built by agents.
Collaboration
- Google Workspace
Agent mailboxes on branded domains (send and receive email).
Data storage and processing
- Apify
Public web and social profile collection for research.
- Bright Data
Web page retrieval for sites that block automated access.
- Firecrawl
Web page retrieval for research.
- Serper
Web and local business search.
Engineering
- Anthropic
Models for agent reasoning and content safety.
- Browser Use
Hosted browsers for web automation tasks.
- E2B
Isolated sandboxes for agent code execution.
- Manus
Alternate executor for long-running research tasks.
- OpenAI
Models for content safety checks and voice.
- OpenRouter
Model routing for agent reasoning, research and drafting.
- Resend
Transactional and agent email delivery, inbound email webhooks.
- Twilio
SMS sending and phone numbers.
- Vapi
Outbound and inbound voice calls.
Finance
It
- Name.com
Registration of customer sending domains.
Marketing
- MailReach
Warmup of agent mailboxes to protect deliverability.
Office operations
- Lob
Printing and mailing physical letters.
Sales
Security
- Cloudflare
DNS, CDN and DDoS protection; DNS for customer sending domains.
