# Osano - **Type:** Software product - **Website:** https://www.osano.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) US privacy software that businesses license for cookie consent and privacy requests. It offers a conditional pledge to cover regulatory fines up to $500,000. ## Osano scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 Osano names an 'Audit Defense' feature and a $500,000 'No Fines, No Penalties' guarantee tied directly to regulator fines and sweep letters (osano.com/pledge), stronger than a generic evidence-trail story, though the guarantee only covers paying enterprise-tier customers who notify Osano within 24 hours and implement the platform exactly per documentation. ### Qualifications of the people who do the work: 3/5 Osano's Trust Center names a dated SOC 2 Type II report (Security, Availability, Confidentiality, Privacy; April 2025-March 2026) and a pen-test attestation, but the report itself is gated behind a 'Request access' click and Osano holds no ISO/IEC 27001 or 42001 certification, unlike several compliance-automation peers (trust.osano.com). ### What it publishes about fees: 2/5 Only the Free ($0/mo) and Plus ($199/mo) tiers show a dollar figure on osano.com/plans/cookie-consent; the 'Basic Privacy' plan marked 'Popular' and all higher/enterprise tiers are 'Custom', gated behind a sales conversation. ### Knowledge of your sector: 2/5 Osano's Solutions pages segment by company size and buyer role (GRC/risk, legal, non-privacy-experts, start-ups, enterprise) and by regulation (GDPR, CCPA/CPRA), not by regulated industry vertical, and publish no HIPAA/PCI-DSS/FedRAMP-style sector modules (osano.com/solutions/grc-risk-security). ### Independence from what it sells: 3/5 General security posture rests on an independently audited SOC 2 report hosted via a third-party trust-center platform (Vanta), but Osano's headline AI claims - 'first privacy AI to pass the CIPP/US Practice Exam' and an internally 'adopted' responsible-AI policy - are self-declared, with no accredited external AI-management-system certification such as ISO/IEC 42001 (osano.com/features/ai-powered-osano; trust.osano.com FAQ). ### Who carries the risk if the advice is wrong: 4/5 Osano's Trust Center lists a Certificate of Insurance among its resources and the company backs its product with a named $500,000 fine/penalty guarantee with published eligibility terms, a more concrete disclosed commitment than a bare SLA, though it functions as a marketing guarantee rather than traditional professional-indemnity cover (osano.com/pledge; trust.osano.com). ## Sources for Osano Every line carries the page it was read on and the date it was checked. - Legal entity confirmed on SEC EDGAR (Form D filer index) - Source: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001797445&type=D&dateb=&owner=include&count=40 - Checked: 2026-09-20 - Own security certifications disclosed via Trust Center - Source: https://trust.osano.com - Checked: 2026-09-20 - Public subprocessor list names no AI/LLM vendor - Source: https://osano.trusthub.com/subprocessors - Checked: 2026-09-20 - 'No Fines. No Penalties.' guarantee terms - Source: https://www.osano.com/pledge - Checked: 2026-09-20 - Published pricing covers only two of several tiers - Source: https://www.osano.com/plans/cookie-consent - Checked: 2026-09-20 - Corporate structure: Public Benefit Corporation and B Corp - Source: https://trust.osano.com - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - Names a dated SOC 2 Type II report (Security, Availability, Confidentiality, Privacy; April 2025-March 2026) plus a separate pen-test attestation, hosted on an independent Vanta-run trust-center platform rather than left as a bare, undated marketing claim. - Backs its product with an industry-unique, named $500,000 'No Fines, No Penalties' guarantee that ties the vendor's own money to regulatory fines and penalties. - Operates as a Delaware Public Benefit Corporation and states it is the first Certified B Corporation in data privacy, an external accountability structure most privacy-software vendors do not carry. - Publishes an unrestricted public subprocessor list and Data Processing Addendum rather than gating basic data-flow disclosures behind a sales call. ## Things to check Each one carries the factual basis it rests on. - Osano's own security certifications stop at SOC 2; it holds no ISO/IEC 27001 or ISO/IEC 42001 certification, unlike several compliance-automation peers that hold an accredited AI-management-system certification. - Basis: trust.osano.com 'Compliance' section shows only SOC 2 and GDPR badges; no ISO entry appears anywhere on the Trust Center. - Osano markets AI features that classify cookies, route subject-rights requests and answer privacy questions, but its public subprocessor list names no AI/LLM vendor, and the dedicated 'Osano AI and Responsible Use FAQs' document is gated behind a Trust Center access request rather than published openly. - Basis: osano.trusthub.com/subprocessors lists 17 named subprocessors with no AI/LLM entry; trust.osano.com Resources lists the AI FAQ document as 'Request access' only. - The flagship $500,000 guarantee excludes free-tier customers, requires exact undeviated implementation per Osano's documentation and immediate adoption of every platform update, and does not apply to anything predating full paid implementation, narrowing when the headline claim actually pays out. - Basis: osano.com/pledge sets out these eligibility conditions verbatim. - Full platform pricing is never published; only the Free tier and one $199/mo self-service tier carry a dollar figure, with the 'Basic Privacy', Enterprise and Premier tiers all gated behind a quote request. - Basis: osano.com/plans/cookie-consent shows 'Custom' for the Basic Privacy tier and above; osano.com/plans references 'self-service plans' with no further published figures. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.