Effective Date: 01/01/2025
Website: https://ostrackit.com
Company: OS Track IT by One Stop Tek, Inc. (“we,” “us,” or “our”)
1. Overview
OS Track IT is committed to protecting customer data, maintaining transparency, and operating in compliance with applicable laws, industry standards, and regulatory frameworks. This Legal & Compliance Statement outlines our adherence to key data protection, security, and operational requirements governing software-as-a-service (SaaS) and IT management platforms.
2. Data Privacy Compliance
2.1 General Data Protection Regulation (GDPR)
For customers in the European Economic Area (EEA), OS Track IT acts as a data processor under GDPR Article 28.
We process personal data only under the direction of our customers and implement appropriate technical and organizational measures to protect it.
Customers may execute a Data Processing Addendum (DPA) upon request to formalize GDPR compliance obligations.
2.2 California Consumer Privacy Act (CCPA)
OS Track IT complies with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
We do not sell, rent, or share personal information for marketing purposes and honor all user rights to access, delete, or restrict personal data as defined by law.
2.3 Other Privacy Regulations
We follow applicable privacy frameworks in other jurisdictions where our customers operate, including Canada (PIPEDA) and state-level U.S. data privacy laws.
Our Privacy Policy outlines specific details about data collection, retention, and user rights.
3. Data Security and Hosting
3.1 Infrastructure
All OS Track IT services are hosted in secure, Tier III or higher data centers located in the United States. Hosting providers maintain compliance with ISO 27001, SOC 2 Type II, and ISO 22300 standards.
3.2 Encryption
- In Transit: All data transmitted between your device and our servers uses TLS 1.2+ encryption.
- At Rest: Databases, backups, and logs are encrypted using AES-256.
- Key Management: Encryption keys are managed securely and rotated regularly in accordance with NIST standards.
3.3 Access Controls
Access to systems and data is governed by role-based access control (RBAC), multi-factor authentication (MFA), and principle of least privilege.
Administrative access is logged, monitored, and periodically reviewed.
4. Compliance Frameworks and Certifications
While OS Track IT itself is not yet formally certified under all frameworks, our infrastructure and operational practices align with the following standards:
| Framework / Regulation | Compliance Approach |
|---|---|
| SOC 2 Type II | Hosting infrastructure and data centers certified; internal policies modeled after SOC 2 controls |
| ISO/IEC 27001 | Aligned with risk management, asset security, and incident response controls |
| ISO 22300 | Hosting environment meets or exceeds ISO 22300 standard |
| CJIS / Criminal Justice Information Services | Not directly applicable; however, access control and encryption meet comparable security measures |
| HIPAA (Health Data) | While not a HIPAA-covered entity, OS Track IT uses HIPAA-aligned security practices for data confidentiality and integrity |
Documentation for compliance alignment and audit summaries are available upon request for enterprise clients under NDA.
5. Business Continuity and Disaster Recovery
- Data Backups: Daily automated backups with 30-day retention.
- Redundancy: High-availability architecture with failover systems in geographically separate data centers.
- Recovery Objective:
- RPO (Recovery Point Objective): ≤ 24 hours
- RTO (Recovery Time Objective): ≤ 4 hours
- Testing: Continuity and recovery processes are tested and reviewed annually.
6. Incident Response and Breach Notification
We maintain a formal Incident Response Plan consistent with NIST standards.
In the event of a confirmed data breach, we will:
- Investigate immediately and contain the incident.
- Notify affected customers within 72 hours of confirmation.
- Provide details on impact, remediation, and preventive measures.
All incidents are logged, reviewed, and followed by a root-cause analysis.
7. Subprocessors
We only engage reputable subprocessors that meet our security and compliance requirements. Subprocessors are used solely for hosting, email, and payment processing functions.
A current list of subprocessors can be obtained by emailing compliance@ostrackit.com.
8. Legal Requests and Law Enforcement
We comply with lawful data requests while protecting customer confidentiality:
- We require valid legal process (e.g., subpoena, warrant).
- We notify affected customers unless prohibited by law.
- We do not provide direct access to customer data without proper authorization.
9. Policy Review and Updates
This Legal & Compliance Statement is reviewed annually or upon significant regulatory change. Updates will be published on our website with an updated effective date. Customers are encouraged to review it periodically.
10. Contact Information
For compliance inquiries, audits, or documentation requests, please contact:
OS Track IT / One Stop Tek, Inc.
📧 Email: compliance@ostrackit.com
🌐 Website: https://ostrackit.com