Security
Privileged data stays privileged.
Onboardin5 holds what people tell you before they've even hired you. Here's how it's protected, in plain language, and what it does and doesn't cover.
Who can open Maria's consult?
Only when you’ve assigned us
Our Team
Our team opens your workspace only when assigned to your firm, with a stated reason that shows up in your audit trail.
Every request
Five checks between a consult and anyone who wants to see it.
These run every time someone opens a record or a tool asks for one.
Signed in with an email link
The link goes to the person's work email. Nobody types a password to get in.
Check 1Two-factor confirmed
Required for every firm on the platform today. The same check sits behind the app's screens and its admin requests.
Check 2A member of this firm
The database only returns your firm's records, and each request is checked against firm membership on top of that.
Check 3Sensitive fields unlocked
The most sensitive fields are encrypted at rest and only decrypted for a request that passed the checks above.
Check 4Written to the trail
Setting changes and every hand-off to your tools are written to your firm's trail. Sign-ins are recorded too, on a separate platform log.
Check 5In place today
What protects the data between checks.
Encrypted in transit
Every connection uses TLS, and browsers are told to refuse anything less.
Encrypted fields at rest
The most sensitive answers get their own layer of encryption, field by field.
Signed hand-offs
Every update sent to your tools is signed with a key unique to your firm, so your tools can trust where it came from.
Support access on record
LFA staff open your workspace only when assigned to your firm, with a stated reason that lands in your audit trail.
No trackers in the app
This website's analytics are allowed on the marketing pages only. The app's security rules don't let them load.
Managed backups
The platform is backed up on a managed schedule by our hosting provider.