Four commitments. Built into the platform from day one.
Security at Cogneris isn't a checklist bolted on at the end. These four principles are wired into every code path, every deploy, every customer integration.
Platform encryption controls
The Cogneris platform supports TLS in transit and AES-256-GCM encryption at rest with per-tenant keys managed in Google Cloud KMS where the service and workflow are configured for it. Customer-managed keys are a roadmap capability.
Strict tenant isolation
API requests are scoped to a tenant at the database layer, with tenant-aware authorization and query boundaries. Dedicated compute and single-tenant VPC deployment are roadmap capabilities unless explicitly included in a signed deployment scope.
Least-privilege access
Role-based access control. MFA required for every employee account. Production access follows a dual-approval workflow with time-bound permissions and audit logging. Engineer access to customer document content requires a documented business reason and reviewer approval.
Configurable audit metadata
Supported workflows can record tamper-evident metadata with timestamps, requestor identity, model version, and prompt and response hashes. Coverage, export, and retention depend on the configured service, tenant, and contract.
Where your documents live, and how long.
We're explicit about every stage. No surprise retention, no opaque storage. Defaults are conservative; everything is configurable per contract.
Ingestion
TLS 1.3 from your endpoint to our API. Document bytes are never persisted in access logs. Request metadata is logged without document content.
Processing
Extraction runs in-memory only during inference. No document data crosses tenant boundaries. Sub-processor LLM calls are configurable per tenant — including no-LLM workflows.
Storage
The platform supports encryption at rest with per-tenant keys where configured. Data-retention periods are tenant-configurable and contract-specific, including workflows configured to discard source documents and extracted content after processing.
Deletion
Hard deletion at retention expiry. A 30-day soft-delete window protects against accidental loss; on request, we hard-delete immediately. Audit metadata is retained per your contract.
Audit export
Configured workflows can produce tamper-evident metadata including prompt and response hashes, model version, reviewer identity, and timestamps. Retention is tenant-configurable and contract-specific.
Subject requests
As a processor, Cogneris routes data subject requests (access, deletion, portability under GDPR or CCPA) to the controller — you. We provide tooling and a 30-day SLA for fulfillment.
Working with regulated industries.
We're transparent about where we are on each framework. Where an audit is in progress, we say so. Where it isn't, we say that too. Trust packets — including DPA, security questionnaire responses, and current audit reports — are available on request.
GDPR — for our EU customers
Cogneris acts as a data processor under GDPR Art. 28. Our standard Data Processing Addendum incorporates the EU Standard Contractual Clauses for transfers outside the EEA, and binds every sub-processor to equivalent terms. Sign the DPA at legal@cogneris.ai.
CCPA / CPRA — for our California customers
Cogneris is a service provider under CCPA §1798.140(ag). We do not sell or share personal information. Data subject requests (right to know, delete, correct, opt out of sharing) are routed to the controller; our SLA is 30 days from receipt.
SOC 2 Type II — for our enterprise customers
SOC 2 Type II readiness is in progress; no report has been issued yet. Our SOC 2 System Description and a completed security questionnaire are available under NDA — email security@cogneris.ai.
HIPAA — for healthcare workflows
HIPAA is out of scope for v1: Cogneris does not offer a Business Associate Agreement and does not process protected health information. Send de-identified documents. The HIPAA scope decision is published in the trust center.
The infrastructure behind Cogneris.
We list every sub-processor that handles customer data, what they do, and where they operate. Customers receive at least 30 days' notice before any addition or change, with the right to object under the DPA.
| Sub-processor | Purpose | Region | Data accessed |
|---|---|---|---|
| Google Cloud Platform | Cloud hosting, Cloud Run, Cloud SQL, GCS object storage, KMS, Secret Manager | EU (europe-west1) for EU-region tenants; US (us-central1) for US-region tenants, non-production environments, and shared administrative processing | Documents, extractions, account metadata, logs, secrets |
| Google Cloud Vertex AI | AI inference, document extraction, classification | EU or US depending on tenant and model configuration | Document content during inference, prompts, extracted fields |
| Amazon Web Services | Biometric face comparison (Amazon Rekognition CompareFaces) for identity verification | EU (eu-west-1) for EU-region tenants; US (us-east-1) for US-region tenants | The selfie and the identity-document portrait submitted for comparison; never any other document content |
| OpenAI | AI inference, document extraction, document Q&A | US | Document content during inference, prompts, extracted fields |
| Anthropic | AI inference, document Q&A, agentic workflows | US | Document content during inference, prompts, extracted fields |
| New Relic | Observability: application performance monitoring, logs, metrics, traces, and browser monitoring | US | Operational telemetry, stack traces, request and database metadata, IP address and browser telemetry for end users who consent to analytics; document bodies are scrubbed before egress |
| Fingerprint | Device intelligence for login fraud detection and account takeover prevention | US | Browser and device characteristics, IP address, and a persistent visitor identifier; never document content |
| Google reCAPTCHA | Bot and abuse defence on sign-in and sign-up | US | IP address, browser characteristics, and interaction signals on authentication pages; never document content |
| Stripe | Payment processing, billing, invoices | US | Billing contact, payment tokens, invoice metadata; never document content |
| Twilio SendGrid | Transactional email and email notifications | US | Email address, message metadata, transactional content; never customer documents |
| Twilio | SMS, WhatsApp, MFA and notifications | US | Phone number, message metadata, transactional content; never customer documents |
| ipapi.co | IP geolocation lookup for authentication security auditing | Unconfirmed; vendor evidence pending | IP address; SSO discards the geolocation response and does not persist returned country, country-code, or city fields |
Subscribe to sub-processor change notifications to receive updates 30 days before any change. For planned private VPC and customer-managed-key capabilities, see the private cloud roadmap.
If something goes wrong, customers hear from us first.
We maintain a documented incident response plan with defined roles, escalation paths, and customer communication commitments. The headline numbers we hold ourselves to:
≤ 1 hour
From a confirmed alert to incident commander assigned, severity classified, and customer-impact assessment started.
≤ 48 hours
For a confirmed personal-data breach affecting Customer Data: notification to affected customers within 48 hours of confirmation, designed so you can meet your own GDPR Art. 33 72-hour deadline.
≤ 10 business days
Written post-incident review delivered to affected customers, including root cause, mitigations, and corrective actions.
Notifications include — to the extent then known — the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for follow-up. Subsequent updates are issued as more information becomes available. Notifications are sent to your account-designated security contact and, on request, to a customer-supplied PGP-protected email address. Full breach-notification terms are in our DPA.
Service state is published, not asserted.
Use the single canonical status entry point to choose a production region and inspect its current component state, incident history, and 90-day availability strip: status.cogneris.ai. The regions run independently and are reported independently.
Measured availability across 19 monitored components in the EU production region only was 99.78% over 2026-08-05 to 2026-10-29 (86 complete days), with no single component below 98.5477%. That is an observation, not a commitment — the contractual uptime SLA is a separate figure with service credits attached, and it is set out in your agreement. The measurement method is written out on the status page.
Found something? Tell us.
We respect security researchers and respond to good-faith reports within 1 business day. We commit to working transparently with reporters and crediting their work.
How to report
- Email security@cogneris.ai with a clear description of the issue, reproduction steps, and impact.
- If the issue is sensitive, request our PGP key in your initial email; we'll respond with one within four business hours.
- Please give us 90 days before public disclosure. We commit to fixing critical issues within 30 days, high-severity within 60, and to credit you in the changelog (if you'd like).
In scope
- cogneris.ai and all
*.cogneris.aisubdomains - The Document AI REST API and webhook system
- Authentication, session and tenant-isolation logic
- Customer dashboards and review queues
Out of scope
- Self-XSS / clickjacking on pages without sensitive actions
- Issues in third-party services we sub-process to (report directly to the vendor)
- Rate-limiting and brute-force on public endpoints (we have those covered)
- Best-practice header reports without a demonstrated exploit
Need DPAs, audit reports or a security questionnaire?
Most enterprise security questionnaires take us under 1 business day. Sub-processor notification subscriptions, DPAs, current SOC 2 status and our pen-test summary are all available on request — no NDA gate for the high-level docs.