Independent profile — not affiliated with Oneleet

Oneleet

Oneleet Inc., a Delaware corporation with a stated primary place of business in Beaverton, Oregon (the Terms refer to it as "Oneleet"), sells SOC 2, ISO 27001 and other compliance programs to business customers, combining software, penetration testing and a virtual CISO; the company says an independent third-party audit is included in all of its SOC 2 packages. Its July 30, 2026 Terms provide for automatic renewal for periods equal to the initial term unless either party gives notice at least 30 days before the term ends, and state that fees are "non-refundable and non-cancellable." Oneleet says it raised a $33M Series A led by Dawn Capital in October 2025. No lawsuit or regulator action naming Oneleet was identified in the sources checked on 2026-09-30, and USAComplaints has no complaints about it.

COMPLAINTS0
VERIFIED PHONE—
LAST CHECKED2026-09-30
Be the first to share your experience
VERIFIED

Contacts & Login

VERIFIED

Locations

TypeAddress
Headquarters9450 SW Gemini Dr, PMB 89141 Beaverton OR 97008-7105
Mailing address111B S Governors Ave #6771 Dover DE 19904
EDITORIAL

Signing or renewing with Oneleet? What the Terms say

Oneleet: the July 30, 2026 Terms identify the provider of the services as Oneleet Inc., a Delaware corporation, and refer to it as "Oneleet." Oneleet describes itself as selling SOC 2, ISO 27001 and other framework compliance through one platform that also offers penetration testing, code scanning, a virtual CISO (vCISO) and third-party audits performed by independent auditors. Pricing is not published: Oneleet's pricing page says its "pricing model depends on a few factors specific to your needs" and directs visitors to book a demo for a custom quote. What you owe and for how long is therefore set by your quote or order form, and the Terms say that if an organization has a separate signed agreement (an "MSA"), "such MSA will control."

Points from the current Terms that business customers usually need before signing or renewing:

  • Payment: "All Fees are due within 30 days from the date of invoice or purchase. All fees are non-refundable and non-cancellable." Unpaid amounts carry "a finance charge of 1.5% per month on any outstanding balance, or the maximum permitted by law, whichever is lower, plus all expenses of collection."
  • Renewal: the Terms run for the service term in the order form and "will be automatically renewed for additional periods of the same duration as the initial service term, unless either party notifies the other party of its intention not to renew at least thirty (30) days prior to the end of the then-current term." Put that date on your calendar; the Terms also say notices must be in writing (section 12.7).
  • Price changes: Oneleet may change fees "at the end of the then-current service term by providing a 30-day notice."
  • Billing errors: to receive an adjustment or credit, contact Oneleet "no later than 60 days after the closing date on the first billing statement in which the error or problem appeared."
  • Order form vs. Terms: "In the event of any inconsistency between the terms stated in quote and these Terms, the terms in the quote prevail." Read the quote or MSA first.
  • Contacts: [email protected] (the footer's "Send feedback" link), [email protected] for data requests, and [email protected] on the Trust Center. The pages checked on 2026-09-30 did not show a company phone number.

If you need to act on an existing contract (the Terms describe no dedicated form or portal for any of these; what applies to you depends on your quote or MSA):

  • Cancel mid-term: the published Terms contain no general right to end a contract early for convenience and describe no cancellation procedure; section 6.1 says fees are "non-refundable and non-cancellable." Termination for the other party's material breach (section 8.2) and non-renewal (section 8.1) are separate things. Check your quote or MSA for any separate right.
  • Avoid renewal: find the exact end date of your current term in your order form and give written notice of non-renewal at least thirty (30) days before it. Section 12.7 says notices must be in writing and lists delivery methods (personal delivery; e-mail or fax where receipt is electronically confirmed; overnight courier; certified or registered mail) but names no notice address, and the Terms do not say that a message to [email protected] counts as contractual notice, so use any notice address in your quote or MSA and keep proof of delivery and acknowledgment.
  • Dispute an invoice: section 6.1 gives 60 days from the closing date of the first billing statement showing the error and says inquiries "should be directed to our customer support department" without naming a form or address (the site's listed support contact is [email protected]). The Terms do not say that collection or the 1.5% monthly finance charge in section 6.2 pauses while a dispute is reviewed.
  • Dispute a cancellation fee: section 2.9(b) applies where Oneleet considers that the customer failed to cooperate; the fee is the greater of the total contract value or Oneleet's actual costs. The Terms give no calculation method, documentation right or appeal process, and no separate dispute contact.
  • Escalate an audit problem: the pages checked on 2026-09-30 describe no audit-escalation path, service deadline, named auditor or refund mechanism. Oneleet's October 2, 2025 blog says "We guarantee audit outcomes," while section 9 of the Terms says Oneleet makes no warranty "AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF SERVICES." Keep your quote or MSA, any promised timeline and the guarantee wording, and raise the issue in writing with your Oneleet account or vCISO contact and [email protected].

Before you sign, or if a renewal notice arrives, ask Oneleet in writing which audit firm will issue your report, whether you can choose it, and which items in your quote are covered by the price. Oneleet's own blog suggests customers ask SOC 2 vendors: "Do I get a choice of vetted, independent auditors?"

EDITORIAL

About Oneleet Inc.

According to the Terms and Privacy Policy (both last updated July 30, 2026), the provider is Oneleet Inc., a Delaware corporation whose stated "primary place of business" is 9450 SW Gemini Dr, PMB 89141, Beaverton, OR 97008-7105; the Privacy Policy gives a mailing address of 111B S Governors Ave #6771, Dover, DE 19904. The site footer reads "© 2026 Oneleet Inc." and the Trust Center names "Oneleet, Inc." as the subject of its SOC 2 Type 1 document. The Terms are governed by Delaware law (section 12.8).

What the company says the service includes. Oneleet's Products page lists a Compliance Platform, Penetration Testing, a Code Security Scanner, Attack Surface Discovery, Third-Party Audits, vCISO and security programs, an Employee Portal with MDM, a Trust Center and Access Reviews. Its Frameworks page says "a 3rd party audit" by "an independent AICPA auditor is included in all SOC 2 packages" and that an "OSCE certified penetration test" is bundled into the SOC 2 program. A September 25, 2026 Oneleet blog post says: "Oneleet's all-in price covers the platform, a managed audit, a manual pentest, and your vCISO for the whole engagement, with no separate retainer." The Terms (section 2.2) add that services "may include implementation services, audit support services (such as configuration of integrations and collection of your data and policies, evidence collection, and auditor coordination), and other professional services necessary to provide the Services described in the quote or order form." The scope that applies to you is the one in your own quote or order form.

Oneleet's own compliance status. On its Trust Center on 2026-09-30, Oneleet listed ISO 27001 as "Certified" and SOC 2 Type 2 as "In progress," and offered an "Oneleet, Inc. SOC 2 Type 1" document and an ISO 27001 certificate through a "Request access" button. Those are Oneleet's own statements; this page has not seen the documents.

Funding and size, as stated by the company. In an October 2, 2025 blog post signed by CEO Bryan Onel, Oneleet announced a "$33M Series A led by Dawn Capital," naming Frank Slootman, Arash Ferdowsi and Y Combinator among other participants, and said it "grew to 8-figure revenue profitably without touching our seed funding." Its home page says it is "Trusted by 1,000+ teams to pass audits." These are company statements and were not independently verified.

Status. Oneleet's status page (status.oneleet.com) showed "All Systems Operational" when checked on 2026-09-30. The Terms (section 3) say Oneleet will use "commercially reasonable efforts to make the Services available 24/7, except for planned maintenance or any unavailability caused by circumstances beyond our reasonable control."

EDITORIAL

Complaints and review sites

USAComplaints has no approved complaints about Oneleet, so this page contains no complaint themes from our own records.

External review sources checked on 2026-09-30:

  • G2: Oneleet's G2 listing (marked "Claimed") displayed 4.9 out of 5 from 140 reviews. G2 is a software-review site; that figure is reported as displayed and is not combined with any other source.
  • Trustpilot: the profile URL trustpilot.com/review/oneleet.com returned a "page not found" message, and the first page of results for a Trustpilot search for "oneleet" listed no Oneleet entry.
  • ComplaintsBoard: a site search for "Oneleet" returned "No reviews matching the Oneleet term have been found."
  • Better Business Bureau: a nationwide search for "Oneleet" listed no business with that name (it returned similarly spelled names), and a search for "Oneleet Inc" near Beaverton, OR returned no results.

G2 showed a review listing; no Oneleet profile was found on Trustpilot, ComplaintsBoard or BBB in the searches described above (run on 2026-09-30). That does not show how customers experience the service.

EDITORIAL

Is Oneleet Legitimate?

Oneleet Inc. is named in Oneleet's Terms as a Delaware corporation with a stated primary place of business in Beaverton, Oregon, and the same entity name appears in the website footer. Oneleet publishes Terms and a Privacy Policy (both dated July 30, 2026), a Trust Center, a status page and documentation, and lists support, privacy and security email addresses. This page did not check Delaware or Oregon corporate registries.

In the sources checked on 2026-09-30, no such item appeared in the searches described here: CourtListener returned no docket or opinion with Oneleet in the case name and no opinion mentioning Oneleet in its text, and a general web search for lawsuits, FTC or attorney general actions and security incidents returned nothing about Oneleet. State court dockets, regulator databases and breach-notification repositories were not searched individually, so this is a scoped finding, not proof that no such matter exists. Complaints and lawsuits, if any exist, would be allegations. Review-site results are described in the section above.

Nothing on this page is a rating or verdict. The contract terms quoted above are ordinary points to read in any vendor agreement; whether they fit your situation depends on your own order form or MSA.

EDITORIAL

Frequently Asked Questions

Which company operates Oneleet?

The Terms (last updated July 30, 2026) say the services are offered by "Oneleet Inc., a Delaware corporation, with its primary place of business at 9450 SW Gemini Dr, PMB 89141, Beaverton, OR 97008-7105, USA." The Privacy Policy lists a mailing address at 111B S Governors Ave #6771, Dover, DE 19904, and the website footer reads "© 2026 Oneleet Inc."

What does an Oneleet SOC 2 package include?

Oneleet's Frameworks page says "a 3rd party audit" by "an independent AICPA auditor is included in all SOC 2 packages" and that an "OSCE certified penetration test" is bundled into the program. Its September 25, 2026 blog says the all-in price "covers the platform, a managed audit, a manual pentest, and your vCISO for the whole engagement, with no separate retainer." Pricing is by custom quote, and the Terms say the quote's terms prevail over the Terms, so the list of what you actually bought is in your own order form.

Does an Oneleet contract renew automatically?

According to section 8.1 of the Terms, the Terms "will be automatically renewed for additional periods of the same duration as the initial service term, unless either party notifies the other party of its intention not to renew at least thirty (30) days prior to the end of the then-current term." Oneleet may change fees at the end of a term with 30 days' notice (section 6.1). A separate MSA, if you signed one, controls over the Terms.

Can I cancel Oneleet mid-term or get a refund?

The published Terms (July 30, 2026) do not provide a general right to terminate mid-term for convenience; check your quote or MSA for any separate right. Section 6.1 states: "All fees are non-refundable and non-cancellable." Section 8.2 lets either party terminate on 30 days' notice (or without notice for nonpayment) if the other party materially breaches, and section 8.3 says "All Fees become immediately due and payable upon termination." Section 2.9(b) says that if a customer does not provide the cooperation and information Oneleet needs, Oneleet "may consider the quote null and void" and the customer agrees to "a cancellation fee equivalent to the total contract value or the actual costs borne by the Company, whichever is greater." Oneleet's archived earlier terms (oneleet.com/terms-old, which shows "Effective as of March 1, 2023"; the current page calls them "previous terms as of March 6, 2026") used "25% of the total contract value or the actual costs borne by the Company, whichever is greater," and said that in case of inconsistency the Terms prevail over "any other document, including the provided quote," whereas current section 12.9 says the terms in the quote prevail. Which fee wording and precedence rule applies depends on the contract and Terms version that govern your agreement. The Terms name no cancellation form or portal; to avoid renewal, send written notice at least 30 days before the term ends (section 8.1) using the notice method in your quote or MSA, since section 12.7 names no address. Confirm any other process in writing with Oneleet ([email protected]).

When is payment due and what happens if it is late?

Section 6.1 says fees are due "within 30 days from the date of invoice or purchase." Section 6.2 says unpaid amounts are "subject to a finance charge of 1.5% per month on any outstanding balance, or the maximum permitted by law, whichever is lower, plus all expenses of collection and may result in immediate termination of Service." To dispute an invoice, section 6.1 requires contacting Oneleet "no later than 60 days after the closing date on the first billing statement in which the error or problem appeared," and that inquiries "should be directed to our customer support department." The Terms name no dispute form and do not say that collection or the finance charge pauses during a review.

Who performs the audit, and is the auditor independent of Oneleet?

Oneleet's Products page says "Oneleet works with independent 3rd party auditors to verify your security & compliance controls," and its Frameworks page says the SOC 2 audit is done by "an independent AICPA auditor." The Terms (section 2.2) describe Oneleet's own role as "audit support services" including "evidence collection, and auditor coordination." The pages checked on 2026-09-30 did not name the audit firm or firms. Oneleet's blog on choosing a SOC 2 vendor lists "Do I get a choice of vetted, independent auditors?" as a question buyers should ask, so ask Oneleet who the firm is and whether you can choose it.

Does Oneleet guarantee that I will pass my audit?

Two Oneleet documents say different things. In its October 2, 2025 funding announcement, Oneleet wrote: "We guarantee audit outcomes because our standards are higher than auditors' standards and because everything is verified by our AI team." The Terms (section 9) state: "WE DO NOT WARRANT THAT SERVICES WILL BE UNINTERRUPTED OR ERROR FREE; NOR DO WE MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF SERVICES," and section 10 (printed in capitals) caps liability at the fees received "in the 12 months prior to the act that gave rise to the liability" (with stated exceptions such as fraud and gross negligence). Any written guarantee or remedy you were promised should be in your quote or MSA, which prevails over the Terms. The pages checked on 2026-09-30 describe no audit-escalation path or refund mechanism; keep the quote, timeline and guarantee wording and raise problems in writing with your Oneleet account contact and [email protected].

How does Oneleet handle my data, and how do I make a request?

The Terms say "You will own all right, title and interest in and to Customer Data" (section 5.2) and that on termination Oneleet will "promptly return or, at the your request, destroy, all copies of the Customer Data" (section 8.3). For AI features, Oneleet says it "will not use Input or Output to train, fine-tune, or otherwise develop AI models made available to other customers" (section 2.3(b)). The Privacy Policy lists rights to access, correct and delete personal data, says requests go to [email protected], and says Oneleet responds "within legally mandated timeframes or ... within 45 days" where no legal deadline applies. Subprocessors are listed at trust.oneleet.com, and the Trust Center shows [email protected].