OneTrust makes governance software that helps companies manage privacy, consent and AI governance while automating compliance and reducing risk. Its buyers are privacy, compliance, risk and data teams in large organisations that need to know what data and AI they hold, who may use it and whether that use meets regulation.
Everything runs on the OneTrust AI-Ready Governance Platform, so personal data, AI systems and suppliers are governed from the same records.
At A Glance
| Vendor | OneTrust |
|---|---|
| Category | Governance, risk and compliance, privacy and AI governance |
| Identities covered | AI agents governed by purpose, permissions and allowed actions |
| Deployment | Single platform on a shared data model |
| Agentic AI | AI agent governance, MCP policy enforcement, built-in AI Agents |
| Customers | Aetna, Adobe, Chewy, Samsung, Miller Knoll |
| Certifications | ISO/IEC 27001, 27701 and 27017, ISO 9001, SOC 2 Type II, PCI DSS, HITRUST, TISAX, TX-RAMP |
| Market classification | Governance, Risk & Compliance |
What OneTrust Does
Governance work is usually split across privacy, security, procurement and data teams, each with its own spreadsheets and records. OneTrust puts those domains on one platform so that every team works from the same inventory instead of separate copies. A typical workflow starts with an AI-assisted assessment and continues into ongoing monitoring, with real-time oversight and alerts once a workflow is complete. The same approach now extends from personal data to AI models and agents, so an AI project is reviewed with the same records as the data and suppliers it depends on.
Products
Privacy Automation And Consent & Preferences
These two areas serve privacy teams handling personal data obligations. Privacy Automation draws on the platform’s discovery and classification of sensitive data, and Consent & Preferences manages the consent and preference choices people make about how their data is used.
Data Use Governance
For data and governance teams who need to find sensitive data before deciding how it may be used. Discovery and classification run across the platform’s connectors, and dynamic data graphs link projects, models, datasets, vendors and systems so the relationships between them are visible.
AI Governance
AI Governance gives organisations an inventory of their AI systems, models, agents, datasets, vendors, projects and use cases, and keeps discovering new AI as environments change. Each system receives the same risk evaluation whether it was built in-house or bought from a third party, with templates for the EU AI Act, the NIST AI Risk Management Framework and ISO 42001.
Tech Risk & Compliance
Aimed at risk and compliance teams running recurring assessments and reviews. Automated workflows take over repetitive governance tasks in assessments, onboarding and reviews.
Third-Party Management
For procurement and risk teams managing suppliers. Vendors sit in the same data graphs as the projects, models, datasets and systems they touch, so third-party risk is assessed in context.
How It Works
| Component | What it does |
|---|---|
| Shared data model | Built-in AI capabilities and ready-made AI Agents run on one shared data model, with shared context-aware intelligence and authentication across modules. |
| Connectors | More than 200 data discovery connectors and a catalogue of pre-built integrations feed systems of record into the shared inventory and data graphs, so assessments and monitoring work from current information. |
| Shared services | Role and attribute based access controls, unified audit logs, customer-managed encryption keys and sandbox environments apply across every module, giving administrators one place to manage them. |
Identities And Systems Covered
| AI agents | Governed by a defined purpose, permissions and allowed actions. |
|---|---|
| AI systems | Models, datasets and AI projects held in the AI inventory. |
| Agent tools | The MCP tools each agent is allowed to call. |
| Data systems | Amazon RDS, Amazon Redshift, Amazon DynamoDB, Snowflake and other connected data stores. |
Agentic AI Capabilities
Agent Governance And MCP
OneTrust treats agents as governed objects. Each agent is given a defined purpose, permissions and a set of allowed actions, and MCP governance controls set and enforce which tools an agent may invoke, with audit logs recording the result. This extends the policy and audit model used for data to the actions agents take. OneTrust also ships ready-made AI Agents of its own, which run on the shared data model and help with assessments inside the platform.
Integrations
| Area | Integrations |
|---|---|
| Cloud and data | Amazon API Gateway, Amazon Athena, ALTR |
| Platforms | Microsoft |
| Marketing and customer data | Acoustic, Acxiom, Adobe |
Company Background
| Origins | Developed its first technology platform for responsible data use in 2016. |
|---|---|
| Headquarters | Atlanta, United States. |
| Founder | Kabir Barday. |
| Leadership | John Heyman (CEO and board member), Blake Brannon (Chief Innovation Officer), DV Lamba (Chief Product and Technology Officer), Jim Monroe (Chief Customer Officer), Doug Owens (CFO), Michael Schanker (CMO), Stephanie Glenn (CRO). |
| Scale | 2,000 employees, with more than half of the Fortune 500 as reported customers. |
|---|---|
| Recognition | Included in the 2026 Gartner Magic Quadrant for AI Governance Platforms. |
Note: This overview is compiled from OneTrust’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.