Last Updated: March 31, 2026
This Privacy Policy explains how Onboard.id, Inc. (“Onboard.id,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the Onboard.id platform. We are committed to protecting the privacy of our customers and their users. If anything is unclear, contact us at hello@onboard.id.
1. Who We Are
Onboard.id, Inc. is a Delaware corporation that develops and operates the Onboard.id platform — a purpose-built SaaS solution that automates IGA application onboarding for federal agencies, Department of Defense programs, systems integrators, and commercial enterprises.
For privacy inquiries, contact us at: hello@onboard.id
2. Scope of This Policy
This Privacy Policy applies to:
- The Onboard.id web application and platform (onboard.id)
- The Onboard.id website and any related web properties that link to this Policy
- Communications between Onboard.id and customers, prospects, and users in connection with Onboard.id
This Policy does not apply to third-party products or services that may integrate with the Onboard.id platform.
If you are accessing Onboard.id as an employee, contractor, or Authorized User of a customer organization, your organization’s data processing agreement with Onboard.id and your organization’s own privacy policies also govern how your information is handled.
3. Information We Collect
3.1 Information You Provide Directly
| Category | Examples |
|---|---|
| Account Information | Name, work email address, job title, organization name, phone number |
| Authentication Credentials | Username, password (stored in hashed form), multi-factor authentication settings |
| Contact & Communications | Messages sent to our support team, feedback submitted through the platform, responses to surveys or beta program participation |
| Payment Information | Billing contact name, billing address, purchase order numbers. Payment card numbers are processed by our payment processor and are not stored by Onboard.id. |
3.2 Information Generated Through Your Use of the Service
| Category | Examples |
|---|---|
| Usage Data | Features accessed, workflows initiated, applications onboarded, actions taken within the platform, session duration, frequency of use |
| Log Data | IP addresses, browser type and version, operating system, referring URLs, error logs, timestamps |
| Device Information | Device type, screen resolution, browser settings relevant to platform rendering |
| Configuration Data | Application onboarding configurations created, connector types used, workflow templates built, approval chain structures defined (not the underlying system data) |
3.3 Customer Data
As part of operating the Service, Onboard.id processes data that Customer submits to Onboard.id in connection with application onboarding workflows. This may include system owner contact information, application classification levels, connector types, entitlement structures, approval workflow participants, and identity governance configuration data.
Onboard.id processes Customer Data as a data processor acting on Customer’s instructions. Onboard.id does not sell, rent, or use Customer Data for advertising.
Important: Customers are responsible for ensuring that data submitted to Onboard.id complies with applicable classification requirements. Do not submit classified national security information or other data categories prohibited by your subscription agreement without express written authorization from Onboard.id.
3.4 Information from Third Parties
We may receive information about you from our channel partner Carahsoft Technology Corp. (if you engage with Onboard.id through a Carahsoft program), from identity providers or SSO solutions your organization has configured, or from publicly available sources for sales prospecting purposes.
4. How We Use Information
4.1 To Provide and Operate the Service
- Create and manage user accounts
- Process and fulfill subscription orders
- Provide technical support and respond to inquiries
- Send transactional communications (account confirmations, password resets, service notifications)
- Authenticate users and maintain session security
4.2 To Improve and Develop the Service
- Analyze usage patterns to improve platform functionality and user experience
- Identify and fix bugs, errors, and performance issues
- Develop new features based on aggregated usage data and feedback
- Generate anonymized product analytics and industry benchmarks
4.3 For Safety and Security
- Monitor for and prevent unauthorized access, fraud, and abuse
- Investigate security incidents and respond to potential threats
- Maintain audit logs for compliance and security review
4.4 For Business and Legal Purposes
- Manage customer relationships and communicate about account status and renewals
- Comply with legal obligations, including government contracting requirements
- Enforce our Terms of Service and other agreements
4.5 For Marketing
- Send product updates, release announcements, and information about related Onboard.id products and services
- Conduct webinars, events, and beta programs
- Measure the effectiveness of marketing campaigns
You may opt out of marketing communications at any time by clicking “unsubscribe” in any email or contacting us at hello@onboard.id. Opting out does not affect transactional or service communications.
5. How We Share Information
5.1 Service Providers (Sub-Processors)
We share information with third-party vendors who process data on our behalf to operate the Service. These vendors are contractually bound to use information only for the purposes of providing services to Onboard.id.
| Category | Purpose |
|---|---|
| Cloud Infrastructure | Platform hosting, data storage, compute (e.g., Amazon Web Services — FedRAMP authorized) |
| Authentication | Identity provider and SSO services |
| Customer Support | Help desk and ticketing platform |
| Analytics | Aggregated usage analytics (no Customer Data shared) |
| Payment Processing | Billing and payment card processing |
| Email / Communications | Transactional email delivery |
A current list of sub-processors is available upon written request at hello@onboard.id.
5.2 Channel Partners
If you purchase or access Onboard.id through Carahsoft or another authorized reseller, we may share account and order information with that partner to facilitate your subscription. We do not share Customer Data with channel partners without your authorization.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, information we hold may be transferred to the successor entity. We will provide notice before information is subject to a materially different privacy policy.
5.4 Legal Requirements
We may disclose information when required by applicable law, regulation, legal process, or government request. Where permitted by law, we will notify affected customers of such requests.
5.5 What We Do Not Do
- We do not sell your personal information or Customer Data to third parties.
- We do not share Customer Data with advertising networks or data brokers.
- We do not use Customer Data to build advertising profiles.
- We do not allow third parties to access Customer Data for their own commercial purposes.
6. Data Security
Onboard.id implements administrative, technical, and physical security measures to protect information against unauthorized access, alteration, disclosure, or destruction. Our security program includes:
- Encryption of data in transit using TLS 1.2 or higher
- Encryption of data at rest using AES-256 or equivalent
- Access controls based on least-privilege principles and role-based access
- Multi-factor authentication for platform access
- Regular security assessments, vulnerability scanning, and penetration testing
- Incident response procedures aligned with NIST guidelines
- Personnel security awareness training
Onboard.id operates on cloud infrastructure that supports FedRAMP High authorization where applicable to federal deployments. Customers seeking information about specific security controls and certifications may contact their account team.
No security system is impenetrable. In the event of a security incident involving your data, we will notify you as required by applicable law and our contractual commitments.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Account Information | Duration of the subscription plus 3 years, or as required by law |
| Customer Data | Duration of the subscription plus 90 days (export/deletion options available per Terms of Service) |
| Usage and Log Data | Up to 2 years from collection, unless longer retention is required for security or legal purposes |
| Financial Records | 7 years, as required by applicable accounting and tax regulations |
| Support Communications | 3 years from resolution |
| Marketing Data | Until opt-out or 3 years from last interaction, whichever is earlier |
For federal government contracts, data retention may be governed by applicable Federal Records Act requirements, contract terms, and agency-specific regulations, which may override the general retention periods above.
8. Your Rights and Choices
8.1 Access and Correction
You may access and update your account information through your account settings. For assistance with information not available through self-service, contact hello@onboard.id.
8.2 Data Portability
You may request an export of your account data and Customer Data in a standard machine-readable format by contacting hello@onboard.id.
8.3 Deletion
You may request deletion of your account and associated personal information by contacting hello@onboard.id. Note that we may retain certain information as required by law, and deletion of your individual account does not automatically delete your organization’s Customer Data.
8.4 Marketing Opt-Out
You may opt out of marketing emails at any time by clicking “unsubscribe” in any marketing email or contacting hello@onboard.id.
8.5 California Privacy Rights
California residents may have additional rights under the CCPA and CPRA, including rights to know, delete, correct, and opt out of sale or sharing of personal information. Onboard.id does not sell California residents’ personal information. To exercise your rights, contact hello@onboard.id.
8.6 Virginia Privacy Rights
Virginia residents may have additional rights under the VCDPA, including rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising and profiling. To exercise your rights, contact hello@onboard.id.
8.7 Federal Employees and the Privacy Act
If you are a federal government employee or contractor and your information is maintained in a Privacy Act System of Records, you may have additional rights under the Privacy Act of 1974 (5 U.S.C. § 552a). Contact your agency’s Privacy Officer for information about applicable Systems of Records Notices (SORNs).
9. Cookies and Tracking Technologies
Onboard.id uses cookies and similar tracking technologies to operate and improve the Service.
| Type | Purpose |
|---|---|
| Essential Cookies | Required for the platform to function — session management, authentication, security. Cannot be disabled. |
| Functional Cookies | Remember your preferences and settings to improve your experience. |
| Analytics Cookies | Help us understand how the platform is used in aggregate. Data is anonymized and not linked to individual identities. |
We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings, though disabling essential cookies will impair platform functionality.
10. Children’s Privacy
Onboard.id is an enterprise platform intended for use by organizations and their personnel. We do not knowingly collect personal information from children under the age of 13 (or 16 in the European Union). If you believe we may have collected information from a child, contact us at hello@onboard.id.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date and notify active customers via email or in-product notification at least thirty (30) days before changes take effect. Your continued use of Onboard.id after the effective date constitutes acceptance of the updated Policy.
12. How to Contact Us
For privacy questions, requests, or concerns:
| Method | Contact |
|---|---|
| Privacy Email | hello@onboard.id |
| General Contact | hello@onboard.id |
| Onboard.id, Inc., Attn: Privacy Officer, 23465 Rock Haven Way, Ste 150, Sterling, VA 20166 |
We will respond to privacy requests within thirty (30) days. For complex requests, we may extend this period by an additional thirty (30) days with notice.
