Trust & Security
How Cognocient handles your data
Cognocient is an early-stage company. This page states only what is actually built and verifiable today — not aspirational security marketing.
Data isolation
Every request to Cognocient's API is scoped to your authenticated account — every database query filters explicitly by your customer ID at the application layer.
Provider API keys
The OpenAI, Anthropic, and other provider keys you give Cognocient to proxy your calls are encrypted at rest (Fernet symmetric encryption) and only decrypted in memory for the moment needed to forward a request.
Proxy keys
Your Cognocient proxy key (the sk-cog-… key your app authenticates with) is stored as a bcrypt hash, never in plaintext. Revoking a key takes effect immediately.
Data in transit
All traffic to and from Cognocient is encrypted over HTTPS/TLS.
User accounts
Sign-in and session management run on Supabase Auth, a widely used third-party identity provider, rather than custom-built authentication code.
What we see, and what we don’t
Cognocient is a proxy, not a read-only integration — by design, it sits in your request path so it can attribute cost and enforce budgets before a call happens. That means it does see your traffic in flight to forward it. What it does not do is store your prompt or response content by default: only metadata is logged — token counts, model, feature tag, cost, and latency. Full request/response tracing exists but is opt-in per call, via a request header you control.
If Cognocient is unreachable
Cognocient fails open. If the budget-check layer becomes unreachable, your calls pass through to your AI provider unaffected — you temporarily lose cost visibility and enforcement, but your application keeps working. A Cognocient outage is not designed to take down your production AI features. Read the full behavior.
What we don't have yet
No SOC 2 report, no bug bounty program, and no multi-region data residency offering yet — Cognocient runs on a single-region infrastructure today. We'd rather tell you that plainly than imply otherwise.
Found a security issue?
Please report it to security@cognocient.com.