Security built around your professional records.

HTTPS encrypted connection

OneProfile at oneprofilehealth.com uses HTTPS to encrypt information as it travels between your browser and the website. This helps protect that information from being read or changed in transit.

Encrypted document storage

Uploaded documents are encrypted by the application using AES-256-GCM before storage. This statement concerns document files; it does not mean every database field is encrypted by the application.

Access and sharing

Server-side permissions restrict access by account role, organization, and record ownership. Professionals can create expiring sharing links and revoke them. Anyone with an active sharing link may be able to view the information selected for that link, so share it only with intended recipients.

Account protection

Account security includes password protections, session revocation, login lockout, and optional authenticator-app multifactor authentication. Enable it in your account security settings.

Credential review

Document upload, malware screening, and credential verification are different processes. An uploaded record is not automatically verified. Recorded reviews identify their method, source, and dates. Employers remain responsible for their required credential checks.

Independent assurance

OneProfile has not completed a SOC 2 examination. These safeguards are descriptions of platform controls, not an independent audit opinion or a HIPAA certification.

What the footer notice means

The lock notice describes connection encryption. It is not a third-party security seal, an independent audit result, or a guarantee that a website is free from vulnerabilities.

For organization procurement

Read our data-handling statement or download the security overview (PDF).

Your information and choices

Our Privacy Notice explains what information OneProfile collects, how it is used, and the options available to account holders.