Menu
OneTrust Certification Automation SOC 2 compliance software
Certification Automation is the current name for what OneTrust acquired as Tugboat Logic in September 2021; OneTrust renamed the product effective December 13, 2022 and relaunched it under the new name in March 2023 with 29 frameworks and over 100 integrations.
OneTrust ended renewals for Certification Automation (Tugboat Logic) on 2026-08-31. Existing customers keep access through their remaining subscription, then can extract data for up to 60 days; standard support runs through the subscription or 2027-08-31, whichever is earlier (myOneTrust Tugboat Logic Retirement FAQ). Vendor migration guidance points remaining customers to Tech Risk & Compliance (TRC) on the OneTrust Platform. New Certification Automation purchases are not offered.
By Peter Korpak, Lead Editor · independently researched · Methodology
- Pricing
- Published, from 36K GBP/yr
- Source-checked frameworks
- 2
- Integrations
- 100+
OneTrust ended Certification Automation renewals on 31 August 2026 and documents a migration onto Tech Risk & Compliance (TRC) on the OneTrust Platform. It was sold and reviewed as part of OneTrust's broader Tech Risk & Compliance / GRC and Security Assurance Cloud solution area rather than as a standalone SOC 2 point product, which is also why we could not find a G2 listing scoped to it alone.
OneTrust's last confirmed round was $150 million led by Generation Investment Management in July 2023, valuing the company at $4.5 billion (down from a $5.1 billion valuation in 2021). As of mid-2026, Reuters and other outlets report OneTrust in exploratory private-equity buyout talks (Thoma Bravo and Vista Equity Partners named as possible bidders), but no deal has closed or been confirmed.
OneTrust Certification Automation publishes a price.
You can read the numbers without a sales call, which is uncommon in this category and worth weighing on its own.
- Disclosure model
- Published, from 36K GBP/yr
- Sourced annual price
- GBP 36,180 / year
- Basis
- Confirmed, 2026-07-24
Software pricing alone does not establish the audit fee. A licensed CPA firm issues the SOC 2 report. A commercial offer may package coordination or the fee, so get the legal provider, deliverable, and amount in writing. See the SOC 2 audit cost guide for scope and budget context.
Read the OneTrust Certification Automation pricing guide for the current source table and quote checklist.
What OneTrust Certification Automation does.
Seven capabilities, graded the same way for every platform in the directory. "Not established" means we looked and could not confirm it, not that the feature is missing.
| Capability | Status | Evidence |
|---|---|---|
| Automated evidence collection | Yes | G-Cloud feature list: 'Automated evidence collection'; the March 2023 launch press release claims up to 50% of evidence collection automated. Source |
| Auditor workspace | Yes | G-Cloud feature list: 'Audits and auditor collaboration.' Source |
| Trust center | Partial | G-Cloud lists a 'customer portal to share security reports,' which is trust-page-like but we could not confirm it is a full public-facing trust center product under this module. Source |
| Security questionnaire answering | Not established | The original Tugboat Logic product answered security questionnaires; we could not confirm this feature is still marketed under the current Certification Automation name. |
| Enterprise admin (SSO, SCIM, RBAC) | Not established | OneTrust is enterprise software and likely supports SSO/SCIM/RBAC platform-wide, but we found no source confirming this scoped to Certification Automation specifically. |
| SCIM 2.0 provisioning | Not established | OneTrust documents SCIM 2.0 provisioning for the OneTrust platform login generally, via Okta. Nothing scopes it to the SOC 2 compliance product or names a tier. OneTrust sells SOC 2 as a solution layered on a shared compliance-automation product with no SOC 2 specific SKU, so a platform-wide fact cannot be reported as a fact about the thing a SOC 2 buyer would purchase. |
| Continuous control testing | Not established | Marketing describes 'security posture management' and ongoing evidence collection but does not confirm a scheduled, recurring automated control-test cadence. |
| Native multi-framework support | Partial | Vendor describes a 'proprietary shared evidence framework' that lets teams 'test once, comply many' across more than 29 frameworks, i.e. a shared/crosswalked control model rather than fully separate native control sets per framework. Source |
2 frameworks checked individually, and how well each is established.
A framework on a marketing page is a vendor claim, not a confirmed capability. We grade the difference rather than repeating the list.
| Framework | Evidence | Note |
|---|---|---|
| SOC 2 | Vendor-claimed | UK G-Cloud listing: 'prepare for security audits like SOC 2, ISO 27001 and more.' Source |
| ISO 27001 | Vendor-claimed | Independent trade press coverage of the March 2023 product launch citing 29 supported frameworks including ISO 27001. Source |
Who actually issues the report.
Certification Automation is a self-service compliance-management tool; OneTrust does not issue the buyer's SOC 2 report. The buyer's own licensed CPA firm performs the actual audit and uses the product's auditor-collaboration workspace to request and review evidence.
Software prepares you for the audit; a licensed CPA firm performs it and issues the report. If you have not picked a firm yet, we list independent SOC 2 auditors separately, and we are not one of them.
Who OneTrust Certification Automation is for, and who it is not.
Good fit
A company already standardized on OneTrust for privacy or vendor risk management that wants one vendor relationship covering SOC 2 and ISO 27001 as well.
Poor fit
A first-time SOC 2 buyer. OneTrust ended Certification Automation renewals on 2026-08-31, so this module is not a current purchase path; remaining customers are directed to Tech Risk & Compliance (TRC) on the OneTrust Platform.
Typical buyer: Mid-market to enterprise companies already using OneTrust for privacy or third-party risk that want to add SOC 2/ISO 27001 certification management on the same platform..
Compare OneTrust Certification Automation with three alternatives.
- Comp AI Sponsored
An engineering-led company that values an inspectable, self-hostable compliance platform and wants one vendor scope that can include guided implementation, a trust center, penetration testing, and audit coordination when quoted.
-
A SaaS team under 50 people that wants a published yearly price, will connect GitHub and cloud accounts (read-only), and will bring its own CPA firm.
-
A pre-Series-B SaaS company that wants a hands-on advisory team bundled into the subscription rather than a pure self-serve automation tool.
Sources
If a claim on this page is out of date, this is the list to re-check.
| Establishes | Source | Retrieved |
|---|---|---|
| Official press release confirming OneTrust's acquisition of Tugboat Logic, signed September 2021, expected to close that month; includes CEO quotes from both companies and pre-acquisition Tugboat Logic scale (800 customers, 140 employees). | OneTrust Press | |
| Official March 2023 launch of the Certification Automation name, describing 29 frameworks and over 100 integrations. | PR Newswire / OneTrust Press | |
| Independent trade press coverage of the Certification Automation launch, confirming it sits inside 'the OneTrust GRC and Security Assurance Cloud' and citing the 29-framework, 100+ integration figures. | Help Net Security Press | |
| Official published pricing (£36,180 a licence a year) and feature list (evidence collection, auditor collaboration, customer portal) for OneTrust Certification Automation; listing documents dated May 2024. | UK Government Digital Marketplace (G-Cloud 14), listed by reseller Oyster IMS Marketplace | |
| States the Tugboat Logic name change to Certification Automation took effect December 13, 2022. | OneTrust (myOneTrust knowledge base) Vendor docs | |
| OneTrust raised $150 million in July 2023 at a $4.5 billion valuation, a roughly 12% step down from its prior $5.1 billion valuation. | Crunchbase News Press | |
| G2 tracks OneTrust's certification/GRC capability under the product name 'OneTrust Tech Risk & Compliance' (also called 'OneTrust GRC and Security Assurance Cloud' in reviewer text), not as a separate 'Certification Automation' listing; a current star rating scoped to this module was not independently verified. | G2 Review platform | |
| Tugboat Logic / Certification Automation retirement FAQ: end of renewals 2026-08-31; end of standard support 2027-08-31; after renewal ends, customers can extract data for up to 60 days. | OneTrust (myOneTrust) Vendor docs | |
| Certification Automation Migration Guide: remaining customers are migrated to Tech Risk & Compliance (TRC) on the OneTrust Platform. | OneTrust (myOneTrust) Vendor docs |
← All SOC 2 compliance software · OneTrust Certification Automation review · How we verify
4 facts on this page we could not establish.
Everything above renders with its evidence state, so a gap is visible rather than quietly filled in. If you work at OneTrust Certification Automation, send us the sources and we will fill them.
Verification is free and always will be. It does not change where OneTrust Certification Automation appears in any list on this site, what our reviews conclude, or which platform we recommend to a buyer. We only accept a correction that comes with a source we can check ourselves, and the source is published in the sources list above alongside the date.