OneTrust vs Transcend: how they compare in 2026

AI is shipped and confirmed in the contract, as a layer on a product that works without it. The core is registry and workflow software: a data map, consent banners and preference centers, data subject request automation, vendor and third party inventories, assessment templates for more than fifty standards, and policy approval workflows, all of which work without any model. Where AI appears, it speeds up an existing step, as when an AI assisted risk assessment produces a summary and findings that go to human approval. OneTrust sells AI governance as a subject, keeping registers of a customer's models, agents and datasets and controlling them at runtime, which is the product managing someone else's AI rather than being AI. The Master Terms answer whether AI is used in the services with a plain yes.

The decision layer is rules, not models, and the vendor says so. Transcend's pitch is policy as code: business policy, jurisdictional regulation and consent combined into a deterministic real time decision that systems and agents call before acting. That is deliberately not inference, and the marketing leans on it, promising every use defined and enforced with records ready for audit. AI Features do exist and are defined in the agreement as large language models or other machine learning features of the Services. The AI use cases mostly concern governing other people's models, such as honoring signals not to train and clearing data for AI projects. Remove the models and what a buyer pays for remains: the permissioning layer, consent propagation, fulfillment of data subject requests, the Sombra gateway and the integrations.

Accuracy is neither loudly claimed nor measured, and the document that would answer it is available only on request. The AI assisted assessment on the home page produces a risk summary and graded findings on personal data processing, model accuracy and transparency, which a compliance officer will act on, and no accuracy rate, benchmark, test set or failure mode is published. The product does not retrieve legal authority, so source links and citator checks are not the point; the risk is a wrong risk rating, not a fabricated citation. The Master Terms say the AI Systems Transparency Report is available on request, and its contents could not be read. Checked the home page, trust center, pricing and packaging page and contracting explainer.

Accuracy is asserted in the marketing, measured nowhere, and disclaimed squarely in the agreement. The claims are quantified but unsourced: 174 billion automated data decisions, 99 percent of the addressable audience per purpose, classification at column level updated in real time, and a customer quote putting data visibility at roughly 100 percent. Against that, section 7.4 of the services agreement disclaims any warranty that the Services, including any Outputs from the AI Features, are accurate, complete or reliable, which is a direct disclaimer of the accuracy of AI output and the more candid of the two positions. No precision or recall figure, benchmark or error rate for classification or the AI Features is published on any page read. The product returns permissioning decisions rather than legal authority, so retrieval and citation of sources do not arise.

A review point is drawn with named roles, and the rest of the control structure is incomplete. The AI use case workflow on the home page runs intake, then AI risk assessment, then a review and approve stage with three pending reviewers, Privacy, Security and Legal, then continuous monitoring with real time oversight and alerts. That puts a human gate after the machine output and says who holds it. The AI Governance package adds configurable approvals, attestations and evaluation gates before production, and runtime controls on prompts, outputs, data access and allowed AI actions. Nothing says what the assessment does unattended, when it defers, or what happens when it is wrong, and nothing describes how OneTrust's own models behave, as distinct from the gates it sells.

Human involvement is offered as a configuration choice and never described as a control over model output. The home page says policy as code runs with people in the loop only where the customer wants them, and elsewhere that the review queue is encoded automatically and that runtime policy enforcement replaces manual compliance reviews. That describes where a customer may place a checkpoint, and the selling point is explicitly the removal of manual review, so the question is what happens when an automated decision is wrong. Nothing located answers it. There is no confidence threshold, no deferral path, no review surface described for the AI Features, and no remedy beyond the audit record. Two things favor the customer. Every decision is logged with proof from each system, and section 3.3 of the agreement gives the customer a perpetual license in Outputs while it keeps its rights in Inputs, so the customer controls what it does with what the system produces.

A named customer, a named individual and real figures are published, with no dates. The GOL customer story quotes Bruna Boccini, Head of Compliance and Data Protection Officer at the airline, who says vendor approval fell from almost thirty days to between five and zero, and request completion from fourteen or fifteen days to a few minutes, across seven billion identifiers and thousands of data flows and vendors. A commissioned Forrester Total Economic Impact study reports a 227 percent three year return and a seven month payback, with a documented method. Logos include Adobe, Samsung, Pfizer, Walgreens, Aetna, Atlassian, Maersk and Bristol Myers Squibb, and the vendor claims more than 14,000 customers, including more than half the Fortune 500. No customer story or study found carries a date, and the GOL figures are the interviewee's own account rather than a measured study.

One customer and one named individual are cited, with no figures attached. Robinhood is named on the home page with a quote from Karthik Rangarajan, Head of Security, describing Transcend's role in giving customers control over their data. A second quote is attributed to a named chief executive with no organization given, which reduces its value. The security page has two more quotes attributed only by role and sector: a CISO and data protection officer at a global staffing firm, and a chief information security officer at a global fintech, whose quote carries the only outcome figure located, data visibility improved to roughly 100 percent. Platform claims of 1.9 billion dollars of revenue unlocked, 174 billion automated decisions and 418 million operations and agents governed are unsourced and carry no method. IDC named Transcend a Leader in its 2025 MarketScape for worldwide data privacy compliance software. A customer stories library exists and was not opened, so it may hold a dated outcome with figures.

Published commitments are substantive and contractual, and training is not addressed. A buyer can read before signing: an openly published Data Processing Addendum with version history; a purpose limit under which personal data is processed only for the purposes in the agreement and never bought or sold; customer ownership of all data input; tenant separation in a logically separated cloud database with one production environment per customer; ISO 27701 certification; and deletion or export at any time during the term and for sixty days after. Nothing found says whether customer content is used to train or improve models, a notable silence for a company selling AI governance. Nothing covers third party model providers. Privilege and work product are never mentioned, though the platform is sold to privacy counsel and its workflow assigns a legal reviewer.

Confidentiality is strongly documented, and two parts are missing. Section 3.3 of the services agreement says Transcend may not use Inputs or Outputs to train or otherwise improve AI Features except solely for the customer's benefit, which is a contractual prohibition rather than a policy statement. The Customer Data license at 3.2 is narrow, solely to provide the Services, and improvement rights are confined to Usage Data, which excludes Customer Data. The architecture reinforces the contract. Sombra runs inside the customer's own infrastructure, the customer keeps its own API keys, and Transcend says it cannot connect to customer systems directly and does not see the data. Customer Data is defined as the customer's Confidential Information, compelled disclosure requires prior notice, and the addendum commits to deletion within thirty days of termination on request. Privilege and work product are never mentioned, despite a named Privacy, Legal and Risk buyer, and no position is stated on outside model providers behind the AI Features.

Nothing found addresses the line between an information tool and legal advice, on a product that produces compliance judgments for professionals. The platform assigns risk ratings, generates assessments against the EU AI Act, GDPR and US state privacy laws, and routes them to a reviewer named Legal. In place of an advice position, the Master Terms warrant that the services will materially conform to the OneTrust User Guide during the term. No statement says outputs are not legal advice, OneTrust is not a law firm, no professional relationship arises, or users should seek advice on their own facts, and no jurisdiction limit or supervision and competence discussion appears. The Master Terms PDF and the Legal and Compliance Information page were not opened and may contain a disclaimer. Read: the home page, trust center, pricing page and contracting explainer.

A responsibility allocation sits in the terms while the marketing sells the removal of legal review. Section 7.4 of the services agreement says the customer is solely responsible for its compliance with any laws and that Transcend disclaims all liability for that compliance. Section 2.3 requires the customer to obtain the permissions and consents and comply with the privacy laws the Services need. That clearly allocates who owns the legal judgment, but it says nothing about the line between an information tool and legal advice. Nothing located says the output is not legal advice, that no professional relationship arises, or that a user should take advice on their own facts, and no jurisdiction limit or supervision point appears. The tension is sharp because of how the product is sold. The marketing promises real time campaign clearance and no three week legal review cycles, an explicit offer to replace a legal review step, alongside a disclaimer of all liability for the compliance outcome.

A real governance framework is published, without results. The trust center says OneTrust's AI governance program is run by an interdisciplinary AI Governance Committee, supported by governance processes across the organization and the AI lifecycle, an internal AI use policy and employee training. That names an accountable body, a lifecycle scope and two instruments, backed by a Responsible AI section, a published Journey to AI Governance toolkit and an AI Systems Transparency Report. No individual is named as accountable; the committee is identified only by function. Nothing is disclosed on uneven output, with no bias evaluation, testing regime or result on any public page, a notable gap for a vendor that sells bias and drift monitoring to others. The AI Systems Transparency Report is available on request, not published, and was not read.

Nothing published addresses governance of Transcend's own models. The company publishes a good deal about AI governance as a subject, including a solution built around enforcing signals not to train and a blog arguing that AI governance is enforcement rather than documentation, but all of it concerns the customer's AI. No responsible AI page, AI policy, ethics statement, governance committee, named accountable owner, testing regime before release or bias evaluation is published. The site navigation and full footer were read across platform, solutions, partners, resources, company and developer sections, and contain no such page. Two nearby items do not answer the question. The contractual commitment not to train is a data commitment, and the open source repositories and public documentation are engineering transparency rather than model governance.

Retention, deletion, access control, subprocessors and incident practice are all published and specific. Retention is set by the customer, with built in data minimization including automatic deletion and retention periods that OneTrust encourages customers to shorten. Customers may delete or export their data in a structured, machine readable format at any time during the term and for up to sixty days after, after which remaining data is destroyed. Access is managed by the customer, with ISO 27001, 27017 and 27701 certification and security duties set out in Appendix 1 of the published DPA. Subprocessor changes carry thirty days' notice and a right to object on reasonable data protection grounds, remedied by an alternative or termination of the affected subscription. Incidents are notified without undue delay, with updates and cooperation on the customer's own reporting. Encryption is AES-256 at rest and in backup and at least TLS 1.2 in transit, and the trust center publishes a 2026 penetration test summary and disaster recovery and continuity exercise memos. The subprocessor list itself sits on the customer portal, not the open trust center.

The full stewardship picture is published, specific and dated, in a data processing addendum last updated 27 August 2026. On termination Transcend deletes all Customer Personal Data in its possession or control within thirty days of a customer request, with backups isolated and protected from further processing; without a request, deletion follows standard retention policies. Security breaches are notified without undue delay and within seventy two hours of awareness, with a set list of content covering the nature of the breach, the categories and approximate numbers of people and records, likely consequences and measures taken. Subprocessors are named on a maintained public list, with fifteen days' notice of additions, an objection route and a mutual termination right if no cure is available. Access control is concrete: SSO with enforced MFA, least privilege and role based access, segregation of duties, and quarterly access reviews. Encryption is AES-256 at rest and TLS 1.2 or higher in transit, with annual outside penetration testing, threat modeling at design, code analysis and dependency checks, and daily backups tested at least annually. Transfers run on the EU SCCs, the UK addendum and the Swiss FADP variations.

What the vendor stands behind is published, specific, versioned and independently assessed. The Master Terms of Service are published in full in a legal center, currently version 5.1 effective 23 March 2026, with every earlier version back to August 2020 downloadable alongside the DPA, Standard Contractual Clauses, Business Associate Agreement and product terms. Each party's liability is capped at total annual fees paid or payable in the prior year, which OneTrust notes is broader than the common cap tied to fees for one service, with willful misconduct and intellectual property claims uncapped. An indemnity covers third party IP infringement claims from use of the cloud services, with OneTrust controlling the defense. A warranty commits the services to conform materially to the User Guide for the term. A plain language explainer, Contracting with OneTrust, sets this out and explains why OneTrust refuses uncapped liability for data breach. An independent TermScout assessment rates the terms 70 percent customer favorable with a perfect score against buyer deal breakers. Nothing addresses wrong AI output, and no insurance position is stated.

The allocation is published, current and readable, and the indemnity is narrow. The services agreement, last updated 9 July 2026, is published openly and was independently assessed under the TermScout certification program. It sets a mutual cap at fees paid or payable in the twelve months before the event. Excluded Claims sit outside the cap: customer breaches of use restrictions, indemnity amounts payable to third parties, and either party's breach of confidentiality. A conformance warranty says the Services will operate in substantial conformity with the Documentation and that functionality will not be materially reduced during the term, with correction, performing again or a refund of prepaid fees as the exclusive remedy. A separate warranty says Transcend will comply with all applicable laws in providing the Services. Transcend's indemnity covers only third party intellectual property claims, with none for misuse or unauthorized disclosure of Customer Data, and the confidentiality carve out expressly excludes claims about Customer Data, so a data incident stays inside the cap. No insurance position is published, and an incorrect AI output is addressed only by a disclaimer.

Integration is clearly part of the offering, but no connection could be named from the pages read. An Integrations page sits in the platform menu, described as an extensive set of integrations for adding data management to existing workflows; Third-Party Management automates vendor assessments with ecosystem integrations; the consent product scales through APIs across channels; and some services ship components customers install themselves, such as cookie consent scripts and data discovery agents. OneTrust is also sold through the Azure Marketplace, with its own supplemental terms. No specific system is named on the pages read, no API reference or developer documentation was found, and nothing says what moves in which direction. The Integrations page was not opened and may say more.

Named systems, a described flow and public developer documentation are published, without a stated approach to what is not covered. Integrations named on the home and security pages span the categories that matter here: Okta and Workday for identity and HR, Databricks, AWS and Azure for data, Slack and Twilio for communications, Google Ads and AdRoll for marketing, and Google Workspace for productivity. Segment is named in the agreement as an example of a customer's third party service. What moves is described. Consent decisions propagate to the customer data platform, ad tech and loyalty systems, data subject requests are fulfilled across connected systems with proof from each, and every request passes through Sombra tokenized, authenticated and encrypted. The connector model is documented publicly at docs.transcend.io, with an API built for MCP agent access and open source repositories on GitHub. The integrations library and the documentation site were not opened, so depth beyond the named systems is unverified and they may say more.

Tenancy is stated plainly, residency is offered, and processing location is left open. The contracting explainer describes cloud services on shared architecture, code and infrastructure, with customer data in a logically separated cloud database and each customer given a single production tenant, plus nonproduction environments in some subscriptions and more available to buy. Customers can choose from various geographic hosting locations. HIPAA and PCI compliant environments are available for specialized needs, backed by a published PCI attestation and a HITRUST certification. The available regions are not listed, so a buyer must ask, and processing location is not distinguished from storage, which matters for the AI features since no model or provider is named.

The deployment model is clear, and the residency detail is thin. Transcend publishes an architecture in two parts rather than a hosting note: a hosted control plane, and Sombra, a security gateway the customer deploys inside its own infrastructure, through which every integration request passes. The consequences are stated concretely. Customer data never leaves the customer environment, Transcend cannot connect to customer systems directly, and the customer keeps its own API keys, with optional delegation to its own key management service for keys backed by hardware. The data processing addendum confirms this, recording that where the customer uses Sombra less personal data is collected, because it runs on the customer's premises with encryption end to end. That answers where processing happens more directly than a region list would. The region list itself is missing. The addendum says customer data is stored and processed by default in a secure cloud environment on AWS, but no regions are listed, no residency option is offered, and nothing describes what changes between deployment tiers.

Current, independent attestations can be downloaded directly as PDFs, with no form, email capture or NDA click: a SOC 2 Type II report, a second SOC 2 Type II for Certification Automation, ISO/IEC 27001, 27701, 27017 and ISO 9001 certificates, and a published Statement of Applicability showing which controls are in scope. Alongside them sit a PCI DSS attestation signed November 2025 with a responsibility matrix, a HITRUST certification letter, TISAX, TX-RAMP, the Spanish ENS conformity statement, and a CAIQ v4.0.3 self assessment on the Cloud Security Alliance STAR registry. Documentation goes beyond certificates to a 2026 penetration test summary, a completed SIG questionnaire, a security, privacy and architecture whitepaper, disaster recovery and continuity exercise memos, and a live status page. All of this is openly published.

The standards are named, and none of the confirming detail is published. The security page says Transcend regularly attains SOC 2 Type II and ISO 27001 compliance and shows the AICPA SOC and ISO 27001 marks. The data processing addendum repeats both, recording that Transcend has obtained SOC 2 Type II certification and maintains ISO 27001 certification, with its security and privacy programs audited externally each year. Supporting practice is described in depth: annual outside penetration testing, external audits, threat modeling at design, static code analysis and dependency checks, manual application security testing, and claimed alignment with the Cloud Computing Compliance Controls Catalog, the NCSC Cloud Security Principles and NIST cloud standards. Nothing lets a buyer verify it. There is no trust center, no report is downloadable or offered on request, no auditor or certification body is named, and no certificate date, examination period or scope appears. The phrase regularly attains is looser than a claim of current certification and is the vendor's own wording.

AI use is confirmed, and nothing underneath it is named publicly. The Master Terms answer whether OneTrust uses AI in the services with a plain yes and point to the AI Systems Transparency Report, available on request. No model, family, provider or architecture is named on any public page read, and nothing rules out a third party foundation model, so a customer cannot tell whose model produces its assessments and documentation. Inference location is not separated from storage. No commitment to notify customers of model changes was found, though the subprocessor process carries thirty days' notice and would cover a model provider engaged as a subprocessor. The transparency report exists and can be requested, but nothing is named where a reader can see it.

The AI Features are defined and nothing underneath them is identified. The services agreement defines AI Features as large language models or other machine learning or AI features of the Services, which confirms such models are in use. No model, model family or provider is named on any page read, and none is excluded. OpenAI and Perplexity appear in the integration strip on the home and security pages, but as customer systems Transcend connects to on the customer's behalf, not as providers of Transcend's own AI Features. AWS is named in the addendum as the default hosting environment, which identifies infrastructure rather than models. No commitment to notify customers when the model set changes is published. The maintained subprocessor list would likely settle this, since a model provider processing customer personal data would have to appear on it. That list was not opened and may say more.

The unit and structure are published in detail, and no figure appears. A pricing and packaging page sets out nine packages across five solution families, each with key features listed so the split between base and suite editions is visible, and each with its own charging meter: AI Governance on admin users and AI inventory; the Consent Management Platform on average daily visitors across channels and properties; Universal Consent and Preference Management on data subject profiles captured; Privacy Automation on users and privacy asset inventory; Tech Risk and Compliance on admin users and asset inventory; and Third-Party Management on admin users and third party inventory. FAQs explain that pricing uses value based usage meters in tiers, with an account executive moving a customer up a tier when usage consistently exceeds limits. No rate, band, floor or currency appears, every package routes to a Get Pricing form, and nothing says what implementation or professional services add.

No pricing information is published at any level, including the unit of charge. The site navigation and the full footer were read across platform, solutions, partners, resources, company and developer sections and contain no pricing page; every commercial route is a demo request. What the published agreement supplies is billing mechanics rather than price or structure: fees are set in an order form, invoice or an in-account billing page, payable in US dollars, invoiced in advance with usage-based fees possibly invoiced monthly in arrears, non-refundable and not subject to set-off, with subscriptions auto-renewing and Transcend able to revise rates on forty-five days' notice before renewal, and past due amounts carrying 1.5 percent monthly. Usage limits are said to be set in the order form or documentation without naming what is metered. A separate Customer Support document defines support tiers with a Standard tier included at no additional charge, which is the only tier structure published anywhere and concerns support rather than the platform.

Coverage is described three ways, with substance, and the boundary is left open. Solutions are organized by function into six families, by role into data, marketing, privacy, and security and risk teams, and by regulation, with pages for GDPR, US privacy law and the EU AI Act plus a wider regulatory index. Tech Risk and Compliance cites templates across more than fifty standards and frameworks, AI Governance aligns to the EU AI Act, NIST and ISO 42001, and third party screening covers politically exposed persons, sanctions and watchlists through Dow Jones data. Published logos span regulated industry, retail, pharmaceuticals, technology and nonprofits. Nothing says where the product stops, such as organization size, data volume or poor fit. The By Role menu, where a legal buyer would look, has no page for legal or counsel, although the product's own workflow assigns a legal reviewer.

Coverage is segmented three ways with real pages behind each, and the boundary is left open. By team, five audiences have their own pages, including Privacy, Legal and Risk, so a legal function is addressed on a page of its own. By use case, five specific ones are named: AI transformation and keeping data out of training, personalization and audience activation, retail media networks, loyalty and programs across several brands, and regulated and sensitive data use. By business type, six are named: AI, consumer, healthcare, fintech, media and business to business. The use cases show who the product is for, since retail media networks and loyalty programs point at consumer enterprises with large first party data estates rather than at regulated industry generally. Where the product stops is not stated. No organization size, data volume, jurisdiction or system type is named as out of scope, and the regulated and sensitive data use case is framed as a capability rather than a limit.