All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This analysis is scoped to OneTrust AI Governance.
OneTrust sells AI governance software to enterprise data, risk and AI teams. It inventories their AI models and agents, checks them against the EU AI Act and similar standards, and enforces their policies. Founded in 2016, OneTrust also sells privacy, consent, data-use and risk products. It has about 2,000 employees and has raised over $1 billion, most recently $150 million in 2023 led by Generation Investment Management. It names Blackbaud and Kuehne + Nagel as AI governance customers and has not published how many it has. In June 2026 Gartner placed OneTrust among the Visionaries in its first Magic Quadrant report on AI governance platforms, with IBM and ServiceNow among the Leaders. OneTrust competes in AI governance on that product breadth and its existing enterprise customers.
| Description | OneTrust sells an AI-ready governance platform that helps organizations inventory and govern AI systems, manage privacy and consent, control data use, run technology risk and compliance programs, and manage third-party risk. | [f1] |
|---|---|---|
| Founded | 2016 | [f2] |
| HQ | Atlanta, Georgia, USA | [f3] |
| Funding | $1,144M total | [f4] |
| Latest funding | $150M round (July 2023, led by Generation Investment Management) at a $4.5B valuation | [f5] |
| Product | What it does |
|---|---|
| OneTrust AI Governance | Discovers AI systems, inventories models and use cases, automates risk assessment against frameworks like the EU AI Act and NIST, and enforces controls across the AI lifecycle. |
| OneTrust Privacy Automation | Automates privacy operations across the data lifecycle, including assessments, data subject requests, and regulatory intelligence. |
| OneTrust Consent and Preferences | Manages consent and preference collection for consumer transparency across web, mobile, and marketing channels. |
| OneTrust Data Use Governance | Applies real-time policy enforcement on data use so data is governed and ready for analytics and AI. |
| OneTrust Third-Party Management | Runs third-party risk management programs across vendor onboarding, assessment, and ongoing monitoring. |
| OneTrust Tech Risk and Compliance | Runs technology risk and compliance programs against ready-to-action frameworks, with prescriptive content, evidence requirements, and remediation workflows. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
OneTrust AI Governance catalogs AI systems, assesses their risk against frameworks such as the EU AI Act and NIST AI RMF, and enforces compliance controls across the AI lifecycle. These capabilities are mapped to the AI Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | OneTrust names the buyer precisely, the enterprise data, risk, and AI team, and the obligation behind the pitch is dated rather than asserted: the European Commission records the EU AI Act as applicable from 2 August 2026. Both figures that size the pain sit on OneTrust's own AI Governance page, a 37% year-over-year rise in time spent managing AI risk credited to OneTrust's own report and a Gartner forecast for 2027 the page relays. The cited record carries no independent measurement of the problem this line sells against. [s2, s13, s3] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | OneTrust's own pages document the line in detail, from a central inventory of models, datasets, agents, and vendors to standards templates and, since March 2026, guardrail enforcement that inspects AI systems in real time and can block exposures when risks arise. OneTrust announces the Gartner placement itself, and the cited record carries no third-party technical evaluation or benchmark of the capability. [s2, s3, s4] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two distinct buyer-side signals sit inside the last year. A regulatory driver: the European Commission records the EU AI Act as applicable from 2 August 2026, with duties on the high-risk uses in sensitive areas from 2 December 2027 and on high-risk systems inside regulated products from 2 August 2028. An analyst category note: Gartner published a Magic Quadrant for AI Governance Platforms in June 2026, which IBM's own announcement dates to 17 June 2026 independently of OneTrust. [s13, s4, s19] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Kabir Barday built OneTrust in the privacy and governance market to nearly $500 million in annual run rate in eight years, a figure a 2024 Forbes article carries, and he stays on the board. John Heyman became chief executive in February 2026 after leading Radiant Systems and Snap One through initial public offerings, so the cited record shows one build in this market alongside two public offerings led at other companies. [s7, s5, s6] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | Blackbaud and Kuehne + Nagel are named as AI governance customers, and Lumen Technologies is named in the same release for privacy operations rather than AI governance. All three reach the record through OneTrust's own announcements, and the reviewed sources carry no independent account of adoption or scale for the line. [s3, s4] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | Scored on the line: OneTrust announced a runtime discovery, policy and enforcement expansion of the AI Governance product in March 2026, and no revenue, margin, or output-per-dollar figure for the line is disclosed. The parent's capital position, more than $1 billion raised and a July 2023 round at $4.5 billion against the $5.1 billion of its 2020 Series C, is a company-level fact that cannot confirm efficiency for the line. [s8, s9, s17, s10, s3] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Gartner published a Magic Quadrant for AI Governance Platforms in June 2026 and placed OneTrust in it, so an analyst has now named the category the line sells into. OneTrust's own pages are the sole record of that placement in the cited sources, while IBM's announcement corroborates the report and its date, so the placement itself carries no independent corroboration and the category is new enough that a buyer still needs it explained. [s4, s19, s2] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | The line sits on a platform that also sells privacy automation, consent, data-use governance, technology risk, and third-party management. The cited record documents that breadth rather than a measured switching cost for the line, and no cited source shows an AI line customer holding the other products. The AI inventory and policy checks reach into Amazon Bedrock, Azure Foundry, Databricks Unity Catalog, and Google Vertex, whose owners could offer the same checks natively. [s1, s3, s18] |
OneTrust sells the AI Governance line to the data, risk, and AI teams inside large enterprises that need to know which AI systems their business runs before they can tell which duties apply. The obligation behind that pitch is dated rather than asserted. The European Commission records the EU AI Act as in force since 1 August 2024 and applicable from 2 August 2026, with duties on high-risk uses in sensitive areas from 2 December 2027 and on high-risk systems inside regulated products from 2 August 2028.
Both figures that size the problem reach the record through OneTrust's own page. That page credits its own AI-Ready Governance Report with a 37% year-over-year rise in the time teams spend managing AI risk, and relays a Gartner forecast that 60% of organisations will fail to realise value from their AI use cases by 2027 because of weak governance. No source here sizes how many enterprises lack an AI inventory, what an unmanaged AI estate costs, or how often the obligation bites. [s2, s13, s3]
The AI Governance line tracks models, datasets, agents, and vendors in a central inventory, standardises risk work against EU AI Act, NIST, and ISO 42001 templates, and produces approvals, attestations, and audit-ready reporting. In March 2026 OneTrust announced continuous discovery of AI agents, a prebuilt AI policy library, and guardrail enforcement that inspects AI systems in real time and can block or limit personal data exposure when risks arise.
The capability set reaches into the environments where AI runs rather than deepening one technical layer. OneTrust names Amazon Bedrock, Amazon SageMaker, Azure Foundry, Azure OpenAI, Databricks Unity Catalog, and Google Vertex as platforms the product integrates with. All of it is documented on OneTrust's own pages, and the cited record carries no third-party technical evaluation or benchmark of the line. [s2, s3, s4]
OneTrust presents the AI line as the newest layer of one governance platform that also sells privacy automation, consent, data-use governance, technology risk, and third-party management. Against a single-purpose AI governance vendor, that breadth is what OneTrust sells. The cited record does not show an AI line customer buying the rest of the platform: OneTrust's March 2026 announcement names Blackbaud and Kuehne + Nagel for AI governance and Lumen Technologies for privacy operations, three separate companies.
Against the platforms the line plugs into, the position inverts. OneTrust's own page names Amazon Bedrock, Azure Foundry, Databricks Unity Catalog, and Google Vertex among the platforms the line integrates with. Each of those platform owners already sits inside the estate the line reaches into and could add AI inventory and policy checks natively. IBM announced its own placement in the Gartner AI Governance Platforms report that also placed OneTrust, so incumbent enterprise platforms are competing in the category Gartner has now named. [s1, s3, s19]
OneTrust positions the AI Governance line to reach buyers through the privacy and GRC relationships the company already holds, and the platform's scale is documented: a 2024 Forbes article puts the company at nearly $500 million in annual run rate and about 2,000 employees. That scale belongs to the parent. The cited record shows no attach, conversion, expansion, or channel figure for the AI line itself.
The reviewed sources name two references for the line. OneTrust's March 2026 announcement names Blackbaud aligning AI practices with NIST's AI Risk Management Framework and Kuehne + Nagel classifying AI use cases under the EU AI Act, and the same release names Lumen Technologies for privacy operations rather than for AI governance. All three reach the public record through OneTrust's own pages, where the AI Governance page also carries a testimonial from Blackbaud's senior manager for data and AI governance. [s3, s7, s2]
Kabir Barday founded OneTrust and built it in the privacy and governance market to nearly $500 million in annual run rate in eight years, a figure a 2024 Forbes article carries. In February 2026 he handed the chief executive role to John Heyman and moved to the board, where OneTrust's About Us page lists him as Founder.
Heyman arrives with a record built at other companies. OneTrust and Corporate Compliance Insights both state that he led Radiant Systems and Snap One through initial public offerings, and the cited pages do not describe what either company sold. The same About Us page lists DV Lamba as chief product and technology officer, so the chief executive role is the one the record shows newly filled. [s7, s5, s6, s16]
OneTrust sells trust and compliance tooling, so buyers scrutinise its own posture. Its trust centre lists SOC 2 Type II audit reports, ISO/IEC 27001, 27701 and 27017 certifications, ISO 9001, and records covering payment, healthcare, and automotive review requirements. The cited sources carry one adversarial record, a denial-of-service report against OneTrust SDK version 6.33.0 that the supplier disputes. That record names the OneTrust SDK rather than any of the solution lines.
The standards the AI line helps customers meet place their duties on the customer. The European Commission's page sets the EU AI Act's obligations on providers and deployers of AI systems, and NIST states that its AI Risk Management Framework is intended for voluntary use, so nothing in the cited record requires a buyer to purchase a product of this kind. Assurance here eases a procurement review, and the cited sources show no certification or authorisation scoped to the AI Governance line that would block a buyer from moving to a replacement. [s15, s12, s13, s14]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Credo AI | competes with | OneTrust's AI governance page describes it alongside OneTrust in the Visionaries quadrant of Gartner's AI Governance Platforms report. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| IBM | competes with | Announced its own Leader placement in the Gartner AI Governance Platforms report that also placed OneTrust. | N/AIBM is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| ServiceNow | competes with | OneTrust's AI governance page describes it in the Leaders quadrant of the same Gartner AI Governance Platforms report. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Holistic AI | competes with | OneTrust's AI governance page describes it in the Challengers quadrant of the same Gartner AI Governance Platforms report. | N/AWe scored these companies at different scopes, so the totals measure different things. |
Add analyzed competitors to compare them side by side with OneTrust.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
pivot urgently
The AI Governance software would not slow a funded rival for long. Its policy library and assessment templates are built from published standards. The customer configures and runs the product, and no cited source shows a regulation that requires buying a product of this kind. OneTrust sells privacy automation, consent, data-use governance, technology risk and third-party management as one platform. For a customer that bought that combination, a switch would have to replace it rather than the AI line alone. The cited record names no such customer and does not size what a migration off the platform would cost. The Amazon, Azure, Databricks and Google platforms the AI line reaches into could each carry equivalent inventory and policy checks inside estates the buyer already owns.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers buy software for AI inventory, risk scoring, policy automation, and audit-ready evidence, and they configure and run it themselves. The customer's own programme owns the governance outcome, and the documentation the product emits is software output rather than a judgment OneTrust accepts accountability for. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | The AI line accumulates the inventory, assessments, and policy records a customer wires into its AI stack, and it connects to Amazon Bedrock, Azure Foundry, Databricks Unity Catalog, and Google Vertex, which is meaningful integration and workflow friction. The cited record does not size the migration: it documents no dependent system that consumes the line's record at runtime and no replacement cost for leaving it. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | OneTrust's trust centre lists SOC 2 Type II, ISO/IEC 27001, 27701 and 27017, ISO 9001, and payment, healthcare, and automotive industry records, which a funded competitor obtains through ordinary enterprise preparation. The cited record scopes none of them to the AI Governance line and shows no regulation or authorisation that blocks replacing it. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 2/3 | Turning the EU AI Act, NIST, and ISO 42001 into templates, workflows, and evidence, and discovering AI agents across an environment, is substantial governance engineering. The real-time guardrail enforcement that would carry this higher was announced in March 2026 and carries no independent evaluation in the cited record. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Kuehne + Nagel uses the line to classify AI use cases under the EU AI Act, a binding regime, and OneTrust describes it as a global leader in transport and logistics. Blackbaud is a second reference named to the AI Governance line rather than to the parent's roster, and no cited source sizes it, so Kuehne + Nagel is the one buyer the cited record places under a binding regime. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | OneTrust inventories, assesses, and enforces policy on AI systems, models, and agents that belong to the customer and run on Amazon, Azure, Databricks, and Google platforms. It sits above those systems as a governance platform rather than as infrastructure they need in order to run. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | What the cited record evidences for the AI line is a prebuilt policy library and templates built from published standards, the EU AI Act, NIST, and ISO 42001, alongside per-tenant inventory and assessment records held on the customer's behalf. No vendor-retained corpus scoped to this line is named or sized. |
OneTrust sells the AI Governance line to data, risk, and AI teams inside large enterprises, the audience its March 2026 announcement names for the product. The same release names Blackbaud aligning AI practices with NIST's AI Risk Management Framework and Kuehne + Nagel classifying AI use cases under the EU AI Act through centralised intake, and it names Lumen Technologies for privacy operations.
The segment is precise and the pressure behind it is dated. The European Commission records the EU AI Act as applicable from 2 August 2026, with duties on high-risk uses in sensitive areas from 2 December 2027 and on high-risk systems inside regulated products from 2 August 2028. OneTrust names Amazon Bedrock, Azure Foundry, Databricks Unity Catalog, and Google Vertex among the platforms the line reaches into, so the budget line it competes for is one those platform owners can also claim.
The AI Governance line tracks models, datasets, agents, and vendors in one inventory, standardises risk work against EU AI Act, NIST, and ISO 42001 templates, and produces approvals, attestations, and audit-ready evidence. The March 2026 announcement added continuous discovery of AI agents, a prebuilt AI policy library, and guardrail enforcement that inspects AI systems in real time and can block or limit personal data exposure when risks arise.
The engineering is broad rather than deep in one layer, and it reaches into the platforms where AI actually runs: OneTrust names Amazon Bedrock, Amazon SageMaker, Azure Foundry, Azure OpenAI, Databricks Unity Catalog, and Google Vertex. The runtime enforcement is the newest part and the least tested in public, and no third-party technical evaluation or benchmark of the line appears in the cited record.
OneTrust the parent runs an enterprise sales motion sized for a business a 2024 Forbes article puts at nearly $500 million in annual run rate, and it positions the AI Governance line to reach buyers through the privacy and GRC relationships it already holds. That is positioning rather than measured conversion. The cited record carries no attach, expansion, or renewal figure for the AI line.
What the line does carry is two named AI governance references, Blackbaud and Kuehne + Nagel, and a Visionary placement in Gartner's Magic Quadrant for AI Governance Platforms. Both the references and the placement reach the record through OneTrust's own pages, where the AI Governance page also carries a testimonial from Blackbaud's senior manager for data and AI governance, so a buyer checking the reviewed sources for an outside account of adoption finds none.
The AI Governance page offers a demo and a conversation with sales rather than a published price. No commercial unit appears on it, so whether governance sells as a platform subscription or as a metered control is not stated.
Sales-led pricing fits an enterprise buyer with a procurement process. Deal size, bundling, and any multi-product commercial unit are absent from the cited pages, so a buyer learns what the line costs by asking rather than by reading.
OneTrust delivers the AI Governance line as software the customer configures and operates, pulling AI systems into a central inventory and review workflow and connecting to the platforms where models and agents run. The customer's own programme produces the governance outcome, and no managed service that accepts accountability for it appears in the cited record.
Delivery is integration-heavy, which ties the line's usefulness to how far a customer wires it into their AI stack. Guardrail enforcement extends that further, because blocking a policy violation in real time makes the product part of how the customer's AI systems run.
OneTrust sells trust and compliance tooling, so buyers scrutinise its own posture. Its trust centre lists SOC 2 Type II audit reports, ISO/IEC 27001, 27701 and 27017 certifications, ISO 9001, and records covering payment, healthcare, and automotive review requirements, alongside public sector and regional attestations.
The standards the AI line helps customers meet place their duties on the customer. The European Commission's page sets the EU AI Act's obligations on providers and deployers of AI systems, and NIST states that its AI Risk Management Framework is intended for voluntary use, so nothing in the cited record requires a buyer to purchase a product of this kind. What assurance does here is ease a procurement review rather than block a replacement.
OneTrust runs the AI line as the newest layer of one governance platform that also sells privacy automation, consent, data-use governance, technology risk, and third-party management. A 2023 account of the platform describes research and regulatory intelligence across hundreds of jurisdictions behind it, and the cited record does not show how much of that corpus reaches the AI line.
The same breadth is the exposure. OneTrust names Amazon Bedrock, Azure Foundry, Databricks Unity Catalog, and Google Vertex among the platforms the AI line reaches into, and those platform owners already sit inside the estate the line is deployed in. IBM announced its own placement in the Gartner AI Governance Platforms report that also placed OneTrust, so enterprise platform vendors are already competing in the category.
Kabir Barday founded OneTrust and built it in the privacy and governance market to nearly $500 million in annual run rate in eight years, a figure a 2024 Forbes article carries. In February 2026 he handed the chief executive role to John Heyman and moved to the board, where OneTrust's About Us page lists him as Founder.
Heyman arrives with a record built at other companies. OneTrust and Corporate Compliance Insights both state that he led Radiant Systems and Snap One through initial public offerings, and the cited pages do not describe what either company sold. The same About Us page lists DV Lamba as chief product and technology officer, so the chief executive role is the one the record shows newly filled.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | OneTrust: platform homepage | official | 2026-08-27 |
| f2 | Insight Partners: OneTrust Secures $300 Million Series C Funding at a $5.1 Billion Valuation led by TCV | press | 2026-08-27 |
| f3 | Forbes: Kabir Barday Builds OneTrust As High Growth Platform For Data Privacy | press | 2026-08-27 |
| f4 | CB Insights: OneTrust company profile | research | 2026-08-27 |
| f5 | Help Net Security: OneTrust raises $150 million to accelerate platform innovation | press | 2026-08-27 |
| f6 | AI Defense Matrix Catalog mapping | other | 2026-08-27 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | OneTrust: platform homepage “Connect privacy, data, AI, and technology risk in one continuous system. Define purpose, automate assessments, enforce controls, and continuously monitor new risks across domains—so your business can innovate quickly, move faster, and stay in control.” | official | 2026-08-27 |
| s2 | OneTrust: AI Governance solution page “OneTrust AI Governance software aligns enterprise governance with technical reality, so teams scale AI faster, reduce risk, and maintain trust.” | official | 2026-08-27 |
| s3 | OneTrust newsroom: AI Governance expansion announcement “OneTrust introduces new observability and enforcement capabilities to enable continuous, run-time control” | official | 2026-08-27 |
| s4 | OneTrust newsroom: Gartner AI Governance Platforms placement announcement “OneTrust Named a Visionary in the Inaugural Gartner® Magic Quadrant™ for AI Governance Platforms” | official | 2026-08-27 |
| s5 | OneTrust newsroom: chief executive appointment announcement “OneTrust Appoints John Heyman As CEO to Drive AI-Ready Governance Platform™ Innovation” | official | 2026-08-27 |
| s6 | Corporate Compliance Insights: OneTrust Names New CEO, Founder Moves to Board Role “OneTrust has appointed John Heyman as CEO, with founder Kabir Barday transitioning to a strategic advisory role on the board of directors, the Atlanta-based governance software company said.” | press | 2026-08-27 |
| s7 | Forbes: Kabir Barday Builds OneTrust As High Growth Platform For Data Privacy “In only eight years, the Atlanta-based company has grown from start-up idea to nearly $500 million in annual run rate (ARR).” | press | 2026-08-27 |
| s8 | Help Net Security: OneTrust raises $150 million to accelerate platform innovation “The round was led by new investor Generation Investment Management with participation from existing investor Sands Capital, bringing the total funds raised to date to over $1 billion with a current $4.5 billion valuation.” | press | 2026-08-27 |
| s9 | Crunchbase News: OneTrust Raises $150M As It Cuts Its Valuation “The valuation represents about a 12% drop from the $5.1 billion valuation the privacy and security startup garnered after it raised a Series C in late 2020 and an extension in 2021.” | press | 2026-08-27 |
| s10 | SEC EDGAR: OneTrust LLC Form D notice of exempt offering “Total Offering Amount $ 149,999,999 USD or Indefinite Total Amount Sold $ 149,999,999 USD Total Remaining to be Sold $ 0 USD” | regulatory | 2026-08-27 |
| s11 | CB Insights: OneTrust company profile “OneTrust raised a total of $1.144B.” | research | 2026-08-27 |
| s12 | NVD record: CVE-2024-57708, OneTrust SDK denial-of-service report, supplier disputes the prototype-pollution classification “An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.” | research | 2026-08-27 |
| s13 | European Commission: AI Act regulatory framework page “The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions:” | regulatory | 2026-08-27 |
| s14 | NIST: AI Risk Management Framework page “NIST AI Risk Management Framework (AI RMF) is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.” | research | 2026-08-27 |
| s15 | OneTrust: Trust Center “Explore OneTrust certifications, audit reports, and related trust records in one place (SOC 2, ISO, and more).” | official | 2026-08-27 |
| s16 | OneTrust: About Us page “We developed the first technology platform for responsible data use in 2016. Ten years later, AI represents the latest and most profound expansion of data use.” | official | 2026-08-27 |
| s17 | Insight Partners: OneTrust Secures $300 Million Series C Funding at a $5.1 Billion Valuation led by TCV “The funding values OneTrust, founded in 2016, at $5.1 billion and brings the company's total money raised in the last 18 months to $710 million.” | press | 2026-08-27 |
| s18 | OneTrust: Tech Risk and Compliance solution page “Streamline compliance with 55+ ready-to-action frameworks, prescriptive content, and evidence requirements broken down into measurable tasks.” | official | 2026-08-27 |
| s19 | IBM announcement: Leader placement in the Gartner AI Governance Platforms report “The first-ever Magic Quadrant for AI Governance Platforms by Gartner is a defining moment for a market category that is still taking shape.” | official | 2026-08-27 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | OneTrust: platform homepage “Connect privacy, data, AI, and technology risk in one continuous system. Define purpose, automate assessments, enforce controls, and continuously monitor new risks across domains—so your business can innovate quickly, move faster, and stay in control.” | official | 2026-08-27 |
| s2 | OneTrust: AI Governance solution page “OneTrust AI Governance software aligns enterprise governance with technical reality, so teams scale AI faster, reduce risk, and maintain trust.” | official | 2026-08-27 |
| s3 | OneTrust newsroom: AI Governance expansion announcement “OneTrust introduces new observability and enforcement capabilities to enable continuous, run-time control” | official | 2026-08-27 |
| s4 | OneTrust newsroom: Gartner AI Governance Platforms placement announcement “OneTrust Named a Visionary in the Inaugural Gartner® Magic Quadrant™ for AI Governance Platforms” | official | 2026-08-27 |
| s5 | OneTrust newsroom: chief executive appointment announcement “OneTrust Appoints John Heyman As CEO to Drive AI-Ready Governance Platform™ Innovation” | official | 2026-08-27 |
| s6 | Corporate Compliance Insights: OneTrust Names New CEO, Founder Moves to Board Role “OneTrust has appointed John Heyman as CEO, with founder Kabir Barday transitioning to a strategic advisory role on the board of directors, the Atlanta-based governance software company said.” | press | 2026-08-27 |
| s7 | Forbes: Kabir Barday Builds OneTrust As High Growth Platform For Data Privacy “In only eight years, the Atlanta-based company has grown from start-up idea to nearly $500 million in annual run rate (ARR).” | press | 2026-08-27 |
| s8 | Help Net Security: OneTrust raises $150 million to accelerate platform innovation “The round was led by new investor Generation Investment Management with participation from existing investor Sands Capital, bringing the total funds raised to date to over $1 billion with a current $4.5 billion valuation.” | press | 2026-08-27 |
| s9 | Crunchbase News: OneTrust Raises $150M As It Cuts Its Valuation “The valuation represents about a 12% drop from the $5.1 billion valuation the privacy and security startup garnered after it raised a Series C in late 2020 and an extension in 2021.” | press | 2026-08-27 |
| s10 | SEC EDGAR: OneTrust LLC Form D notice of exempt offering “Total Offering Amount $ 149,999,999 USD or Indefinite Total Amount Sold $ 149,999,999 USD Total Remaining to be Sold $ 0 USD” | regulatory | 2026-08-27 |
| s11 | CB Insights: OneTrust company profile “OneTrust raised a total of $1.144B.” | research | 2026-08-27 |
| s12 | NVD record: CVE-2024-57708, OneTrust SDK denial-of-service report, supplier disputes the prototype-pollution classification “An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.” | research | 2026-08-27 |
| s13 | European Commission: AI Act regulatory framework page “The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions:” | regulatory | 2026-08-27 |
| s14 | NIST: AI Risk Management Framework page “NIST AI Risk Management Framework (AI RMF) is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.” | research | 2026-08-27 |
| s15 | OneTrust: Trust Center “Explore OneTrust certifications, audit reports, and related trust records in one place (SOC 2, ISO, and more).” | official | 2026-08-27 |
| s16 | OneTrust: About Us page “We developed the first technology platform for responsible data use in 2016. Ten years later, AI represents the latest and most profound expansion of data use.” | official | 2026-08-27 |
| s17 | Insight Partners: OneTrust Secures $300 Million Series C Funding at a $5.1 Billion Valuation led by TCV “The funding values OneTrust, founded in 2016, at $5.1 billion and brings the company's total money raised in the last 18 months to $710 million.” | press | 2026-08-27 |
| s18 | OneTrust: Tech Risk and Compliance solution page “Streamline compliance with 55+ ready-to-action frameworks, prescriptive content, and evidence requirements broken down into measurable tasks.” | official | 2026-08-27 |
| s19 | IBM announcement: Leader placement in the Gartner AI Governance Platforms report “The first-ever Magic Quadrant for AI Governance Platforms by Gartner is a defining moment for a market category that is still taking shape.” | official | 2026-08-27 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.