OneTrust Startup Diligence Report
Proceed only as a data-room-led diligence candidate. Public sources support market relevance and operating scale, but the risk-adjusted view depends on verifying ARR quality, valuation support, customer retention, AI/compliance product liability, competitive win/loss, and workforce stability.
OneTrust Startup Diligence Report
OneTrust is a credible private-unicorn diligence target with strong public evidence of scaled enterprise adoption, broad privacy/GRC/AI-governance product coverage, and active operations. The main diligence constraint is private-data opacity: financial quality, cap table, customer concentration, retention, legal exposure, and product economics are not publicly verifiable.
OneTrust has a $4.5B public unicorn-list valuation and low-confidence revenue estimates, but no audited financials, ARR bridge, cash runway, gross margin, or retention cohorts were public.
Diligence request: Require audited financials, ARR/NRR/churn cohorts, cash/burn, debt, board-approved plan, and full financing documents before valuation reliance.
Vanta, TrustArc, BigID, Securiti, AuditBoard/Optro, and large software platforms overlap material portions of OneTrust scope.
Diligence request: Request win/loss analysis, pricing benchmarks, competitive displacement rates, retention by module, roadmap differentiation, and sales enablement data.
Public sources do not reveal ownership, liquidation preferences, option pool, debt, warrants, or current basis by round.
Diligence request: Request stock ledger, cap table waterfall, investor rights agreements, option/warrant schedules, debt documents, and 409A/valuation materials.
A public 14,000+ customer claim and 70 customer stories support breadth, but top-customer ARR, concentration, churn, payment terms, and renewal quality are not public.
Diligence request: Request top-20 customer schedule, ARR concentration, renewal cohorts, contract terms, reference calls, and churned-logo analysis.
OneTrust sells into rapidly changing privacy, security, and AI-governance requirements; content errors, delayed framework updates, or inadequate AI controls could damage customers and the brand.
Diligence request: Review AI governance architecture, legal-content QA, model-risk controls, update SLA, incident history, E&O insurance, and customer liability language.
The report could not independently verify full IP schedules, litigation, customer liability caps, OSS posture, or regulatory-counsel review.
Diligence request: Request counsel litigation schedule, patent/trademark assignments, OSS scan, customer MSA/DPA terms, insurance schedule, and regulatory legal memos.
Public pages use request-demo flows with no transparent pricing; buyers in GRC/privacy categories can compare bundled suites and negotiate large discounts.
Diligence request: Request ACV distribution, discounting, implementation fee margin, price increases, sales-cycle data, and win/loss detail versus top competitors.
Active hiring and quote-based sales suggest an enterprise GTM, but quota attainment, CAC payback, services capacity, and implementation cycle are not public.
Diligence request: Request pipeline, quota attainment, CAC/payback, implementation backlog, services margin, sales headcount, and partner contribution.
OneTrust is a public-database unicorn with credible operating-scale signals, but financial diligence is mostly private-data dependent: audited statements, ARR, cash, debt, cap table, and customer concentration are not public.
not publicly verifiable confidence: low
No audited financial statements or management accounts were public. A low-confidence analyst estimate suggests about $500M 2024 revenue, but this cannot support valuation without company financials.
| metric | public signal | verification status | investor use | diligence request |
|---|---|---|---|---|
| Revenue | GetLatka estimates 2024 revenue at about $500M and 2023 at about $464M. | partially_verified / low confidence | Rough scale triangulation only. | Audited income statements, ARR bridge, revenue-recognition policy, and cohort exports. |
| Gross margin / services margin | Not publicly disclosed. | not_publicly_verifiable | Cannot assess SaaS quality or implementation drag. | Gross margin by product/services, hosting costs, support costs, implementation margin. |
| Cash runway and burn | Not publicly disclosed. | not_publicly_verifiable | Cannot assess financing need or downside protection. | Cash balance, monthly burn, board plan, debt covenants, runway scenarios. |
| Backlog / accounts receivable | Not publicly disclosed. | not_publicly_verifiable | Cannot assess working capital or collections quality. | Backlog, deferred revenue, AR aging, DSOs, bad-debt reserve, contract liabilities. |
Public financial evidence is insufficient for valuation reliance.
not publicly verifiable confidence: low
No board-approved forecast, operating plan, pricing model, or runway scenario was public. Regulatory AI/privacy demand appears favorable, but forecast predictability cannot be judged without pipeline and cohort data.
not publicly verifiable confidence: medium
CB Insights provides a public $4.5B valuation anchor, and public pages identify founder/board participants, but ownership, preference stack, debt, and dilution are private.
| date | event | amount or valuation | source | verification status | diligence caveat |
|---|---|---|---|---|---|
| 2019-07-11 | Joined CB Insights unicorn list | $4.5B latest known valuation | CB Insights | verified for public tracker row | Requires underlying financing docs and current fair-value confirmation. |
| 2020 | Third-party valuation/funding estimate | $5.1B valuation estimate; $926.4M total funding estimate | GetLatka | partially_verified / low confidence | Analyst/database estimate; company must confirm round history and liquidation preferences. |
| 2026-05-31 | Public current financing status | Not publicly disclosed | Public research corpus | not_publicly_verifiable | Request current cap table, debt, warrants, option pool, SAFEs/notes, and investor rights. |
Only public valuation/funding anchors were used; no private financing documents were available.
| stakeholder or instrument | public position or signal | verification status | diligence caveat |
|---|---|---|---|
| Common/founder ownership | Kabir Barday publicly listed as founder and board member. | partially_verified | Ownership percentage, vesting, voting rights, and transfer restrictions are private. |
| Institutional investors | Insight Partners and Coatue represented on board; financing terms not public. | partially_verified | Request preferred stock terms, side letters, liquidation preferences, and information rights. |
| Options/warrants/RSUs | Not publicly disclosed. | not_publicly_verifiable | Request equity incentive plans, grant schedule, strike prices, refresh grants, and dilution model. |
| Debt / bank lines / off-balance-sheet obligations | Not publicly disclosed. | not_publicly_verifiable | Request credit agreements, liens, guarantees, lease obligations, and vendor commitments. |
Capitalization is a gating private-data request.
not publicly verifiable confidence: low
Tax positions, accounting policies, revenue recognition, equity/warrant/debt history, and basis by investor were not public.
OneTrust has verified public product breadth across privacy, consent, AI governance, risk/compliance, third-party management, and data-use governance, but pricing, module economics, usage, and defensibility are private.
partially verified confidence: medium
Public pages verify a broad platform narrative and multiple product families. Diligence should test actual attach rate, module ARR, implementation burden, customer satisfaction, and maintenance cost for regulatory content and integrations.
| product area | public capabilities | target buyer | evidence status | key diligence gap |
|---|---|---|---|---|
| Consent & Preferences | Universal consent, preference management, cookie consent across websites, mobile apps, OTT, connected TVs. | Privacy, marketing, digital, legal | verified primary-source description | Attach rate, ACV, churn, implementation complexity. |
| Privacy Automation | Privacy operations, data flows, risk assessment, DSR automation, DataGuidance updates. | Privacy/legal/compliance | verified primary-source description | Customer ROI, SLA, support burden, regulatory-update QA. |
| AI Governance | AI lifecycle controls, EU AI Act/NIST/ISO 42001 templates, AI project records. | AI governance, risk, legal, security | verified product positioning | Market adoption, competitive win rate, legal defensibility. |
| Tech Risk & Compliance | Compliance automation, IT risk, 55+ frameworks, 300 jurisdictions. | GRC, security, audit | verified product positioning | Framework maintenance process and control evidence automation accuracy. |
| Third-Party Management | Vendor lifecycle automation, due diligence, risk exchange, cyber-risk insights. | Procurement, security, risk | verified product positioning | Data source licenses, liability terms, false-positive rates. |
Product catalog based on public company pages.
| offering | public pricing signal | likely model inference | verification status | diligence request |
|---|---|---|---|---|
| Core platform / enterprise suite | Request demo / talk to expert; no public price list found in reviewed sources. | Enterprise quote-based subscription plus implementation/services. | not_publicly_verifiable | SKU price book, discount history, implementation fees, renewal uplift, services margins. |
| Consent / Privacy modules | Product descriptions, no public tiers. | Subscription by sites/apps/users/modules; requires confirmation. | not_publicly_verifiable | Module ARR, customer counts, ACV distribution, usage metric, churn by cohort. |
| AI Governance / Tech Risk / Third-Party Management | Product positioning, no public tiers. | Enterprise add-ons / expansion modules. | not_publicly_verifiable | Attach rates, expansion ARR, gross margin, partner/content costs. |
No public price book was located.
Customer breadth is plausible based on 14,000+ public customer claim, enterprise logos, and 70 customer-story results, but current paid status, ARR concentration, churn, and top-customer quality are not public.
partially verified confidence: medium
OneTrust publicly lists enterprise logos and customer stories across privacy, consent, third-party risk, tech risk, AI governance, and data discovery. These sources verify marketable references, not top-customer revenue.
| customer or logo | sector or region signal | public use case | verification status | diligence caveat |
|---|---|---|---|---|
| Boehringer Ingelheim | Healthcare / international | Streamlined data protection processes and transparency foundation. | partially_verified | Need current paid status, ARR, contract term, reference call. |
| Sara Assicurazioni | Insurance / Italy | Cybersecurity, privacy, regulatory compliance under DORA and NIS2. | partially_verified | Need DORA/NIS2 module scope, renewal, expansion, procurement relationship. |
| MillerKnoll | Manufacturing / retail | Privacy and data governance cloud for customer-centric privacy. | partially_verified | Need current contract, modules, price, success metrics. |
| Walgreens / Atlassian / Adobe / Pfizer / Samsung logos | Large enterprise logos | Displayed on platform logo carousel. | partially_verified | Logos do not prove current paid status or size. |
Public logos and case studies are useful but not sufficient customer diligence.
| customer quality item | public signal | verification status | why it matters | request |
|---|---|---|---|---|
| Total customer count | 14,000+ customer claim. | partially_verified | Scale indicator; not revenue quality. | Customer master with active/paid flag and ARR. |
| Customer stories by topic/region | 70 customer-story results and topic/region filters. | verified for page count | Reference breadth across products/geographies. | Referenceability, contract dates, module list, renewal status. |
| Top-15 customers / >5% revenue exposure | Not publicly disclosed. | not_publicly_verifiable | Concentration and renewal risk. | Top-20 ARR, concentration, renewal calendar, churn/downsells, aging receivables. |
Customer concentration is a high-priority gap.
partially verified confidence: medium
Microsoft ecosystem integrations and a broad connector ecosystem are public, but commercial terms, partner-sourced ARR, and dependencies are private.
| relationship or supplier | type | public evidence | dependency or risk | diligence request |
|---|---|---|---|---|
| Microsoft Security Copilot / Azure OpenAI | Technology ecosystem / AI integration | Privacy Breach Response Agent and Azure OpenAI integration coverage. | Cloud/model dependency, data-processing terms, AI reliability. | Microsoft agreements, architecture, data boundaries, security review, customer adoption. |
| Integration ecosystem | Product dependency / partner ecosystem | 500+ pre-built plug-ins via APIs, SDKs, data feeds, integrations. | Maintenance load, connector breakage, security surface. | Top integrations by usage, incident history, integration maintenance team, partner contracts. |
| Third-party cyber-risk data sources | Data supplier / product input | Third-party management page references cyber risk/attack insights. | Licensing, accuracy, update cadence, false positives. | Data-source contracts, QA process, indemnities, model/data lineage. |
Supplier spend, cloud concentration, and partner economics are private.
not publicly verifiable confidence: low
No customer-level revenue, >5% concentration, or contract value data was public.
not publicly verifiable confidence: low
No public source in the scoped corpus disclosed severed customer, partner, or supplier relationships.
partially verified confidence: medium
Microsoft ecosystem signals, integrations, and third-party risk data are public, but cloud hosting, data vendors, contractors, and supplier concentration are not public.
OneTrust competes in a crowded privacy, GRC, data-security, and AI-governance landscape. Competitor-owned public pages show meaningful overlap with Vanta, TrustArc, BigID, Securiti, and AuditBoard/Optro.
verified confidence: medium
Competitors overlap OneTrust from multiple directions: compliance automation, privacy management, data security, AI governance, and audit/GRC. OneTrust breadth is a strength only if customers adopt multiple modules at attractive margins.
| company | segment overlap | public claim or positioning | implication for onetrust | source |
|---|---|---|---|---|
| OneTrust | Privacy, consent, AI governance, tech risk, third-party risk, data-use governance | AI-ready governance platform; 14,000+ customers; 500+ integrations. | Broad suite and enterprise logos are strengths, but breadth demands execution. | OneTrust |
| Vanta | Automated compliance, continuous GRC, risk, third-party risk, trust center, AI | Compliance and Agentic Trust Platform with 400+ integrations. | Modern compliance automation competitor may pressure mid-market and security-led buyers. | Vanta |
| TrustArc | Privacy management, AI governance, DSR automation, vendor risk | Data privacy management software and solutions. | Direct privacy-program alternative with services/regulatory guidance. | TrustArc |
| BigID | Data discovery, security, compliance, privacy, AI risk | Enterprise-scale data discovery, security, and compliance platform. | Technical data-security platform overlap can pull budget from privacy/GRC buyers. | BigID |
| Securiti | Data+AI security, governance, privacy, compliance | Data Command Center for hybrid multicloud. | Platform narrative overlaps AI/data governance positioning. | Securiti |
| AuditBoard / Optro | GRC, audit, risk, compliance, AI-powered controls | AI-powered GRC software trusted by over 50% of Fortune 500. | GRC incumbency and audit buyer relationships may limit OneTrust expansion. | AuditBoard |
Competitor rows rely on competitor-owned marketing pages; request win/loss data.
| axis | onetrust public position | competitive pressure | evidence status | diligence request |
|---|---|---|---|---|
| Product breadth | Broad suite across privacy, consent, AI governance, tech risk, third-party management. | Suite competitors and focused best-of-breed tools. | verified marketing breadth | Module ARR, attach rate, adoption depth, integration telemetry. |
| Regulatory content | Framework/jurisdiction and AI Act/NIST/ISO 42001 references. | Privacy/GRC vendors with legal-content libraries. | partially verified | Content QA process, counsel review, update SLAs, liability limits. |
| Integrations | 500+ integrations. | Vanta claims 400+ integrations; data-security platforms stress broad source coverage. | partially verified | Integration usage by customer, uptime, maintenance cost, security testing. |
| Price / packaging | Quote-based pricing, no public price list. | Procurement can pit modules against focused tools and bundled platforms. | not_publicly_verifiable | Price book, discounting, churn by price increase, win/loss reason codes. |
Scoring is qualitative until win/loss and customer data are provided.
Public GTM evidence points to enterprise direct sales, demo-led conversion, customer references, content marketing, and partner integrations; quantitative sales productivity and channel mix are private.
partially verified confidence: medium
OneTrust positions around responsible data and AI, enterprise trust, compliance automation, and broad customer proof. Public pages support positioning, not CAC, quota, or channel productivity.
| channel | public signal | likely role | verification status | diligence request |
|---|---|---|---|---|
| Direct enterprise sales | Request Demo / Talk to an Expert CTAs and enterprise logos. | Primary new-business and expansion motion. | partially_verified | Sales org size, quota attainment, pipeline, ACV, sales cycle. |
| Customer stories / content marketing | 70 customer-story results across topics and industries. | Proof points for enterprise demand generation. | verified for public page count | Attributed pipeline, conversion, content costs, reference permission. |
| Partner / platform ecosystem | Microsoft Security Copilot and Azure OpenAI integrations; 500+ integrations. | Co-sell, marketplace, and product-led credibility. | partially_verified | Partner agreements, referred ARR, marketplace pipeline, integration usage. |
| Recruiting/geographic footprint | 83 open roles; 13 offices. | Supports sales/customer success/R&D scaling, but not direct demand proof. | verified point-in-time | Headcount by GTM function and geography; hiring plan versus budget. |
Public channel weights are unavailable.
| message or campaign | public evidence | target audience | risk or opportunity | follow up |
|---|---|---|---|---|
| AI-ready governance | Mission and platform positioning around responsible data and AI. | Executives, legal, privacy, AI governance, security | Strong regulatory tailwind but quickly changing category. | Pipeline by AI-governance segment and product usage. |
| Enterprise customer proof | 14,000+ customer claim, logos, 70 customer-story results. | Enterprise buyers and procurement | Scale proof but may overstate current paid deployments. | Logo permissions and customer references. |
| Compliance automation and risk lifecycle | 55+ frameworks, 300 jurisdictions, third-party lifecycle automation. | GRC, security, audit, procurement | Expands TAM but increases content-maintenance burden. | Content QA, product adoption, gross margin by module. |
Marketing signals are primary-source and need pipeline attribution.
partially verified confidence: medium
Public customer stories demonstrate reference breadth, but major-customer trends, expansions, churn, and pipeline are not public.
partially verified confidence: medium
The apparent avenues are demo-led enterprise selling, customer-story proof, regulatory content, and partner integrations, but channel weights are not public.
not publicly verifiable confidence: low
No sales compensation, quota, attainment, CAC payback, productivity by cohort, or sales-cycle data was public.
not publicly verifiable confidence: low
Public hiring indicates resources, but budget capacity, burn, and marketing efficiency were not public.
R&D signals are strong around AI governance and Microsoft integrations, but spend, engineering productivity, roadmap execution, and security/model-risk controls require private review.
partially verified confidence: medium
Public pages identify product/technology leadership and hiring for AI Governance Engineering, but engineering org structure, budget, security reviews, and productivity metrics are not public.
| person or role | public role | r and d relevance | verification status | diligence request |
|---|---|---|---|---|
| DV Lamba | Chief Product & Technology Officer | Likely executive owner for product and engineering roadmap. | verified | Product/engineering org chart, roadmap governance, retention, succession. |
| Blake Brannon | Chief Innovation Officer | Innovation/product strategy signal for AI-ready governance positioning. | verified | AI governance roadmap, patents/invention process, customer advisory board. |
| Senior Principal Software Engineer - AI Governance openings | Open engineering roles in Atlanta and San Francisco | Hiring signal for AI Governance investment. | verified point-in-time | Open requisitions by team, time-to-fill, attrition, roadmap critical path. |
R&D spend and headcount by team are private.
partially verified confidence: medium
The public pipeline centers on AI governance, breach response automation, Azure OpenAI integration, and third-party risk intelligence. Adoption, accuracy, and cost of development remain unverified.
| project or capability | public status | evidence | risk | diligence request |
|---|---|---|---|---|
| AI Governance templates/workflows | Publicly marketed | EU AI Act, NIST, ISO 42001 templates. | Regulatory changes can obsolete content quickly. | Release cadence, legal review process, customer adoption metrics. |
| Privacy Breach Response Agent | Announced / trade-covered | Built with Microsoft Security Copilot. | AI response quality, incident liability, data boundaries. | Security assessment, pilot customers, accuracy metrics, support logs. |
| Azure OpenAI integration for AI governance | Trade-covered integration expansion | Automates capture of agent deployments and centralizes project records. | Dependency on Microsoft platform and model changes. | Partner terms, architecture, customer usage, failure modes. |
| Third-party risk intelligence | Publicly marketed | 20 million cyber risk/attack insights claim. | Data quality and licensing. | Source contracts, QA, refresh cadence, liability caps. |
Pipeline status is public-marketing level only.
OneTrust has a public scaled leadership team, 2,000+ employees, 13 offices, and 83 open roles, but prior layoff history, retention, compensation, equity, and employee-relations matters require private diligence.
partially verified confidence: medium
Public executive and board roles are listed, but full org chart, reporting lines, spans/layers, and succession plans are private.
Reporting lines below CEO are inferred from executive titles and require company confirmation.
partially verified confidence: medium
Company pages show 2,000+ employees, 13 offices, and 83 open roles. Function/location and historical trends are not public.
| signal | public value | date context | interpretation | diligence request |
|---|---|---|---|---|
| Employees | 2,000+ employees on careers page; 2,000 employees on About page. | Accessed 2026-05-31 | Scaled operating footprint. | HRIS by function/location, contractor count, fully burdened cost. |
| Global offices | 13 global offices on careers/About metrics; FAQ says Atlanta HQ with 10 offices around the world. | Accessed 2026-05-31 | Global operating complexity and payroll/legal obligations. | Entity chart, leases, employment-law compliance, office utilization. |
| Open roles | 83 roles; examples include AI Governance engineering, enterprise sales, BI, finance, security, UX, quality engineering. | Accessed 2026-05-31 | Active hiring, especially AI governance and enterprise GTM. | Hiring plan, budget approval, time-to-fill, backfill/new-headcount split. |
Public hiring is point-in-time.
verified confidence: medium
Public leadership roster includes CEO, founder, CFO, product/technology, innovation, customer, legal, and marketing leaders. Detailed biographies and compensation are private.
| name | public role | diligence relevance | source | follow up |
|---|---|---|---|---|
| John Heyman | CEO & Board Member | Executive owner of strategy and fundraising/readiness. | OneTrust About; GlobeNewswire release | Employment agreement, compensation, equity, board minutes. |
| Kabir Barday | Founder / Board | Founder credibility, ownership, board governance. | OneTrust About; Wikipedia | Founder stock, vesting, related-party transactions. |
| Doug Owens | Chief Financial Officer | Finance controls and transaction readiness. | OneTrust About; GlobeNewswire | Finance org, audit history, FP&A process, internal controls. |
| DV Lamba | Chief Product & Technology Officer | Product, engineering, security, and AI roadmap. | OneTrust About | Engineering org, security posture, roadmap delivery. |
| Kim Rivera | Chief Legal & Business Affairs Officer | Legal/regulatory oversight and contracts. | OneTrust About | Litigation, DPAs/MSAs, privacy program, insurance. |
Public bios are limited; request detailed employment/compensation records.
not publicly verifiable confidence: low
Benefits are public, but executive compensation, employee agreements, bonus plans, severance, and pay-equity data are private.
not publicly verifiable confidence: low
No option, RSU, warrant, strike price, vesting, refresh-grant, or equity-plan information was public.
partially verified confidence: medium
Public background reports a 2022 layoff and company pages warn about recruitment fraud. No HR investigations, claims, or employee-relations matters were public.
| signal | public evidence | verification status | risk read | diligence request |
|---|---|---|---|---|
| 2022 workforce reduction | Background source reports approximately 950 layoffs / 25% of staff. | partially_verified | Prior growth reset and morale/retention risk. | Board rationale, functions affected, severance, attrition post-layoff, customer-impact analysis. |
| CFO appointment | Doug Owens appointed CFO in April 2026. | verified | Positive finance-governance signal but transition risk. | CFO mandate, audit history, finance controls, reporting cadence. |
| Recruitment fraud warning | Company warns of fake offers, fake websites, email addresses, group chat, and texts. | verified | Brand-abuse/candidate trust exposure. | Fraud incidents, takedown process, security awareness, legal actions. |
| Compensation/equity arrangements | Benefits listed, but agreements and equity plans not public. | not_publicly_verifiable | Retention and dilution risk unknown. | Employment agreements, comp bands, option/RSU schedules, retention grants. |
No private turnover data was available.
not publicly verifiable confidence: low
Turnover and retention metrics are not public. Public layoff history and current hiring make attrition/productivity diligence important.
Public sources confirm a regulatory-heavy product domain and IP claims, but litigation, IP ownership, material contracts, insurance, privacy incidents, and regulatory correspondence are private counsel workstreams.
not publicly verifiable confidence: low
No counsel-grade litigation schedule or pending lawsuit list was public in the reviewed corpus.
| matter type | public record found | verification status | materiality | diligence request |
|---|---|---|---|---|
| Pending lawsuits against company | No counsel-grade litigation schedule available in reviewed public sources. | not_publicly_verifiable | Could include customer, employment, privacy, IP, or commercial disputes. | Counsel litigation schedule, demand letters, reserves, settlement agreements, materiality thresholds. |
| Privacy/security incident claims | No incident register or regulatory action schedule public. | not_publicly_verifiable | High because OneTrust sells privacy/security/compliance workflows. | Incident register, DPA breach notices, regulator correspondence, E&O/cyber insurance claims. |
Absence from this public corpus is not a legal clearance.
not publicly verifiable confidence: low
No public plaintiff-side litigation schedule was available. Brand-abuse/fraud warning suggests possible enforcement needs, but actions are not disclosed.
| matter type | public record found | verification status | materiality | diligence request |
|---|---|---|---|---|
| Claims initiated by company | No counsel-grade plaintiff schedule available in reviewed public sources. | not_publicly_verifiable | IP, contract, employee, or brand-abuse enforcement could be material. | Counsel schedule of filed/threatened claims, collections, IP enforcement, and counterclaims. |
| Brand-abuse/recruitment fraud enforcement | Careers page warns about recruitment fraud but does not disclose enforcement actions. | partially_verified | Brand trust and candidate harm. | Takedown records, law-enforcement reports, litigation/threat letters, fraud monitoring vendor contracts. |
Request counsel confirmation.
not publicly verifiable confidence: low
As a software company, traditional environmental exposure appears limited, but global offices and hybrid work create workplace safety, employment-law, and local compliance obligations that are not public.
partially verified confidence: low
Public background indicates significant patent claims, but patent/trademark schedules, assignments, OSS usage, and licenses were not independently verified.
| area | public signal | verification status | risk | diligence request |
|---|---|---|---|---|
| Patents / trademarks / proprietary platform | Background source reports 300+ patents; company pages claim AI-ready governance platform and 500+ integrations. | partially_verified / low confidence | Ownership, assignment, infringement, and encumbrance unknown. | Patent/trademark schedules, assignments, maintenance fees, OSS scan, licenses, disputes. |
| Regulatory content and frameworks | GDPR, SOC 2, EU AI Act, DORA, NIST, ISO 42001, 55+ frameworks, 300 jurisdictions. | verified marketing claims | Legal-content accuracy and update obligations. | Regulatory counsel workflow, QA, content-update SLA, disclaimers, liability caps. |
| Material contracts / DPAs / MSAs | Not public. | not_publicly_verifiable | Customer liability, indemnity, SLAs, data-processing commitments, termination rights unknown. | Top customer MSAs/SOWs/DPAs, supplier contracts, subprocessors, data transfer mechanisms. |
| Insurance | Not public. | not_publicly_verifiable | Coverage for cyber, E&O, D&O, EPLI, and regulatory events unknown. | Insurance schedule, claims history, exclusions, limits, renewal quotes. |
Legal and IP diligence requires counsel-grade records.
not publicly verifiable confidence: low
Insurance coverage, claims, exclusions, and limits were not public.
not publicly verifiable confidence: low
Customer MSAs/DPAs, supplier agreements, Microsoft/AI integration contracts, data licenses, leases, and financing agreements were not public.
partially verified confidence: medium
No regulatory-action schedule was public. OneTrust operates in a regulated privacy/security/AI compliance domain where product correctness and incident history are material.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists OneTrust as an Atlanta, United States Enterprise Tech unicorn with a latest known valuation of $4.5 billion. | verified medium | SRC-001 |
| EC-002 | OneTrust appears to remain an active private company founded in 2016 and headquartered in Atlanta, with Kabir Barday as founder. | partially verified medium | SRC-002SRC-003 |
| EC-003 | OneTrust positions itself as an AI-ready governance platform for responsible data and AI use. | verified high | SRC-003 |
| EC-004 | OneTrust publicly claims 14,000+ customers and displays large-enterprise logos across its platform pages. | partially verified medium | SRC-004 |
| EC-005 | OneTrust customer-story index reports 70 results spanning multiple products, industries, and regions. | verified medium | SRC-005 |
| EC-006 | OneTrust product suite spans consent, privacy automation, AI governance, tech risk and compliance, third-party management, and data-use governance. | verified high | SRC-004 |
| EC-007 | OneTrust has publicly disclosed 500+ integrations and API/SDK/data-feed connectivity. | verified high | SRC-003 |
| EC-008 | OneTrust consent products cover consent/preference management and cookie consent across websites, mobile apps, OTT apps, and connected TVs. | verified high | SRC-004SRC-007 |
| EC-009 | OneTrust privacy automation includes privacy operations, DSR automation, and DataGuidance regulatory updates. | verified high | SRC-004SRC-008 |
| EC-010 | OneTrust AI Governance publicly references EU AI Act, NIST, and ISO 42001 templates and lifecycle controls. | verified high | SRC-009 |
| EC-011 | OneTrust Tech Risk & Compliance claims 55+ ready-to-action frameworks and coverage across 300 jurisdictions. | verified medium | SRC-010 |
| EC-012 | OneTrust Third-Party Management claims automation across the third-party lifecycle plus cyber-risk insight datasets. | verified medium | SRC-011 |
| EC-013 | OneTrust public recruiting showed 83 open roles and primary-source claims of 2,000+ employees and 13 global offices. | verified high | SRC-006SRC-003 |
| EC-014 | OneTrust public leadership includes John Heyman as CEO, Blake Brannon, DV Lamba, Jim Monroe, Doug Owens, Kim Rivera, Michael Schanker, and founder Kabir Barday on the board. | verified high | SRC-003 |
| EC-015 | Doug Owens was appointed OneTrust CFO in April 2026 according to a company-distributed news release. | verified medium | SRC-013 |
| EC-016 | Trade coverage reports OneTrust launched a Privacy Breach Response Agent built with Microsoft Security Copilot. | verified medium | SRC-014 |
| EC-017 | Trade coverage reports OneTrust expanded Azure OpenAI integration to automate AI governance workflows. | verified medium | SRC-015 |
| EC-018 | Wikipedia reports OneTrust laid off about 950 employees, approximately 25% of staff, in 2022. | partially verified medium | SRC-002SRC-003SRC-006 |
| EC-019 | GetLatka estimates OneTrust revenue at about $500 million in 2024 and total funding around $926.4 million. | partially verified low | SRC-012 |
| EC-020 | OneTrust public pages push request-demo and talk-to-expert flows rather than transparent public pricing. | verified medium | SRC-004 |
| EC-021 | OneTrust public research did not provide audited financial statements, cap table, option schedule, debt schedule, customer concentration, or revenue-recognition policy. | not publicly verifiable high | SRC-001SRC-003SRC-004SRC-012 |
| EC-022 | OneTrust operates in heavily regulated privacy, security, AI governance, DORA, SOC 2, GDPR, and EU AI Act contexts. | verified medium | SRC-003SRC-009SRC-010 |
| EC-023 | OneTrust careers page contains an explicit recruitment-fraud warning. | verified high | SRC-006 |
| EC-024 | Public background sources and company positioning indicate meaningful IP claims, including a reported 300+ patents claim, but full IP schedules were not verified. | partially verified low | SRC-002SRC-003 |
| EC-025 | Competitor-owned public pages show overlapping platform claims across automated compliance, privacy management, data security, AI governance, and GRC. | verified medium | SRC-016SRC-017SRC-018SRC-019SRC-020 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.