Courier and delivery companies hand us their operational backbone: driver locations, customer addresses, payment details, sometimes patient or prescription information if you’re running medical or pharmacy delivery. That’s not a small ask, and we don’t treat it like one. This page is the honest answer to “how does Onro actually protect our data,” and we’ll keep it updated as our security posture grows. No compliance badges we haven’t earned, no “bank-level security” language that means nothing when you actually ask what it means. Here’s exactly where we stand today.
Onro’s Privacy Policy covers this in full detail, but the short version: we don’t sell your data. We don’t share it with outside parties beyond what’s actually needed to run the service, like a payment processor when you pay or our support tooling when you contact us, and those vendors are contractually required to protect it the same way we do.
That’s different from where your data physically lives. Your data is stored on servers in data centers, the infrastructure the platform runs on, not a third party we’re handing anything to.
We’re GDPR compliant for EEA residents, and here’s what that actually gets you:
Email [email protected] to exercise any of these, and we’ll respond within a month, as required.
If you’re outside the EEA, you get the same rights in practice. We’re not going to build a two-tier privacy program just because a law doesn’t force us to.
Not everyone on your team should be able to touch everything in Onro. So the Admin Center has role-based Groups: create one for support agents, another for fleet managers, another for admins, and decide exactly what each group can see and do, down to individual actions like creating orders or editing routes. A support agent handling customer questions doesn’t need the keys to your dispatcher panel. Now they don’t have them.
Every connection between your team, your customers, your drivers, and Onro runs over SSL/TLS, so data in transit is encrypted. Data at rest is encrypted too. We never store passwords in plain text.
Onro fully supports HIPAA. We’ve signed a Business Associate Agreement (BAA), drafted with legal counsel, and we’re ready to sign one with any customer who qualifies as a Covered Entity under HIPAA. Prefer to use your own BAA instead? We’ll sign that too. Onro already runs medical, pharmacy, and NEMT delivery operations for customers who need their systems to work within HIPAA’s requirements, and here’s what backs that up:
If you’re evaluating Onro for a healthcare use case, talk to us directly about what your setup needs, we’ll walk you through the BAA and the rest.
There’s no such thing as a government-issued “HIPAA certification.” HHS doesn’t hand those out. What matters is the practice and the paperwork behind it, and that’s what’s above: a signed BAA and the features that back it.
Found something that doesn’t look right? Email [email protected]. We don’t have a bug bounty program yet, but we take every legitimate report seriously and respond to it.
No. We only share data with the vendors required to run the service, like payment processors, and they’re required to protect it under the same standards we hold ourselves to. Storing your data on servers in a data center isn’t the same as sharing it with a third party, that’s just the infrastructure the platform runs on.
Yes. EEA residents get the full set of GDPR rights: access, rectification, erasure, restriction, objection, and portability. We respond to any request within a month.
Through role-based Groups in the Admin Center. You decide exactly which panels and actions each group can access, down to individual permissions like creating orders or editing routes.
Data in transit is encrypted via SSL/TLS, and data at rest is encrypted as well. Passwords are never stored in plain text.
Yes. We sign a Business Associate Agreement (BAA) with every healthcare customer who needs one, ours or yours, whichever your legal team prefers, backed by role-based access control, encryption in transit and at rest, optional call masking, and digital proof of delivery. Reach out and we’ll get your BAA in place.
Have questions about anything on this page? Contact us at [email protected].