OneTrust Certification Automation Review: What to Save

Existing OneTrust Certification Automation customers should evaluate a move to Tech Risk & Compliance only after they can retrieve their audit history and confirm who can use it. New Certification Automation purchases are unavailable and renewals ended August 31, 2026, according to OneTrust’s July 16, 2026 retirement FAQ. The buyer mistake is treating a destination demo as proof that completed controls, exceptions, and current collection will survive the move.

Compare with: our Vanta review for a dedicated SOC 2 platform evaluation, or our Drata review to compare the evidence-to-auditor workflow outside OneTrust.

Pros

• Historical evidence collection workflow
• Historical auditor collaboration tools
• Broader-suite users historically reported centralized oversight

Cons

• Certification Automation renewals have ended
• Migrated evidence history needs proof
• Custom reporting needs a live test
• Broader-suite reviews cannot validate migration

OneTrust’s July 1, 2026 migration guide names Tech Risk & Compliance as the destination and lists what does not move. Four gaps change a buyer’s plan most:

• People and access. Default and custom roles, SAML configuration, enforced MFA and notification settings are not migrated. Users on the built-in Auditor or Auditor (Evidence Collection) roles are not migrated either, though auditors on a custom role are. Migrated users land in the root organization with the Project Viewer role and must set a new password.
• Audit history. OneTrust has no dedicated place to store legacy audit requests. Findings are not migrated automatically: export them and import them as issues. Control logs and events and evidence-task comments and logs are also left behind.
• Live collection. Automated evidence collection integrations and security posture alerts are not migrated. Integration credentials must be recreated, and posture alerts can be exported and imported.
• Frameworks. Content tied to a framework OneTrust does not support is excluded.

OneTrust Certification Automation is the former Tugboat Logic product. Historically it offered evidence collection and auditor collaboration for SOC 2 and ISO 27001; those strengths describe the earlier module, not a verified capability transfer to Tech Risk & Compliance. The dated OneTrust software profile holds the product record. Searches for OneTrust certification training concern courses and badges, not this audit workflow. If you are choosing a SOC 2 platform from scratch, start with our guide to how to choose SOC 2 compliance software.

What must survive OneTrust Certification Automation’s migration?

A OneTrust migration succeeds for an audit only if the buyer and CPA can retrieve the right records, with usable ownership and history, in the proposed destination or a retained export. OneTrust’s Tech Risk & Compliance page describes current compliance workflows; its public page does not establish which Certification Automation records transfer. Use this map to set acceptance criteria before signing.

OneTrust’s July 16, 2026 retirement FAQ, as of September 25, 2026, says product access continues through the customer’s remaining subscription and data remains retrievable for 60 days afterward. Standard support ends at subscription expiry or August 31, 2027, whichever comes first. It does not establish a deletion date for your account. Have OneTrust confirm your own subscription end, support end, export window, and deletion terms in writing; archive evidence before normal access ends.

What do OneTrust reviews say about this move?

OneTrust reviews describe parts of the broader platform; they cannot establish whether your Certification Automation history will migrate. Gartner Peer Insights displayed 4.1 out of 5 from 109 Tech Risk & Compliance ratings on September 25, 2026. This is neither a Certification Automation migration rating nor a SOC2Auditors.org score. A July 31, 2025 review describes collaborative vendor-compliance oversight; a January 15, 2025 review describes centralization alongside difficult customization. These individual reports are prompts for a live owner-and-reporting test, not a migration forecast. Employer reviews describe OneTrust as a workplace, not this product.

How can you prove OneTrust’s proposed migration before signing?

A Tech Risk & Compliance demonstration does not show what the guide leaves out. Run these steps on your own audit sample, with the implementation team and your intended CPA:

1. Export what the guide does not migrate, before the access clock runs out. Pull legacy audit requests, findings, control logs and events, evidence-task comments and logs, and posture alerts, then open the files outside OneTrust.
2. Reconcile one completed control from the prior audit period. Compare its source file, approver, and timestamp with the original, and read the migration report for evidence file types it flagged as unsupported.
3. Re-import the findings as issues. Check that each open finding keeps an owner, a date, and a status.
4. Recreate integration credentials and check evidence collection. For one system you cannot replace, show the next collected item, break the source, and show who sees the failure and how it recovers.
5. Rebuild auditor access. Built-in Auditor users do not migrate, and SSO users must exist in OneTrust before migration. Create the CPA’s access, request a sample, and confirm a control owner who arrives as a Project Viewer can still act.
6. Confirm the clock and scope in writing. Get your subscription end, the 60-day extraction window, the support end date, and deletion terms from OneTrust, and match the order and statement of work to the modules and record types you expect.

Run these before signing, and before any cutover that falls inside a current observation period.

Where does the CPA enter OneTrust’s migration?

The buyer owns scope, controls, source systems, exceptions, and retention; OneTrust supplies the proposed workflow; the independent CPA chooses samples, evaluates evidence, and issues the SOC 2 opinion. Historical Certification Automation auditor collaboration is documented in the UK G-Cloud listing, but that older listing does not establish the CPA permissions in Tech Risk & Compliance. Have the CPA test its destination role, request path, and export against a migrated item. The CPA engagement and fee require a separate agreement unless the signed proposal explicitly includes them.

2 attestation-capable CPA firms in our auditor directory list OneTrust among the platforms they work with. A listing does not show experience with Tech Risk & Compliance, so ask your CPA directly.

What will OneTrust’s destination actually cost?

OneTrust publishes no dollar price for Tech Risk & Compliance, and the retiring subscription is not a price for it. Since its Spring 2025 release OneTrust has sold solution packages priced by usage meters such as admin users and the size of the inventory managed. Existing customers move through an account executive’s custom proposal. On September 29, 2026 the UK G-Cloud 14 catalogue listed Certification Automation at £36,180 a licence a year with a 14-day trial, with call-offs open until October 28, 2026. That catalogue row cannot price a 2026 migration or establish today’s support or export rights. Ask for destination modules, licence metric, implementation and data-migration services, support, renewal terms, export assistance, and any parallel-running charge in the order. Keep the independent CPA’s audit fee separate. See the OneTrust pricing guide.

Who should shortlist OneTrust after Certification Automation?

Shortlist the proposed OneTrust route when your team already operates in its wider platform and the migration proofs pass with your CPA. The choice turns on recovered history and operating ownership, not a generic suite score.

If the tests fail, compare SOC 2 compliance software for a replacement.