Security & Trust Center

Document Information

Change Log

Security & Trust Center

Cognispace, LLC is committed to maintaining a security program that meets the expectations of enterprise customers, protects the integrity of our platforms, and upholds the trust of the individuals and organizations whose information we process.

This Security and Trust Center document describes the controls, practices, and commitments that constitute our security program. It is intended to provide enterprise buyers, security reviewers, and compliance teams with an accurate and substantive view of how Cognispace protects data and maintains service integrity.

Security Philosophy

Security at Cognispace is not a compliance posture — it is an architectural commitment. We design our systems, processes, and controls around three foundational principles: confidentiality, integrity, and availability. These principles govern every layer of our infrastructure, every access decision, and every development cycle.

We approach data stewardship as a human-centered responsibility. The information entrusted to our systems — by individuals, enterprises, and institutions — deserves protection proportionate to its sensitivity and the trust placed in us.

1.1 Confidentiality

We limit access to information to those with a demonstrated operational need. Tenant data is logically isolated. Internal access is governed by role-based controls and reviewed regularly. Information is encrypted in transit and at rest across all production environments.

1.2 Integrity

We maintain the accuracy and consistency of data through validated processing pipelines, audit logging, and change-management controls. Unauthorized modification of data is treated as a critical security event and is subject to incident response procedures.

1.3 Availability

We design our infrastructure for resilience. Our systems include redundancy controls, failover capabilities, and disaster recovery procedures designed to support service continuity and minimize the impact of unexpected disruptions.

Infrastructure Security

Cognispace deploys its services on enterprise-grade cloud infrastructure. Our infrastructure selection and configuration prioritize security, compliance readiness, and operational resilience.

2.1 Cloud Hosting

Services are hosted on major cloud infrastructure providers with established security certifications and compliance frameworks. Infrastructure is provisioned, managed, and monitored through automated configuration controls designed to enforce security baselines consistently across environments.

2.2 Network Segmentation

Production environments are segmented from development and staging environments. Network access between internal services is restricted using least-privilege network policies. External access to production infrastructure is limited to authorized endpoints and enforced through network access controls.

2.3 Tenant Isolation

Customer and enterprise workspace data is logically isolated at the application and data layers. Architectural controls prevent cross-tenant data access. Isolation boundaries are validated as part of our application security review process.

2.4 Encryption

All data in transit is protected using industry-standard transport layer encryption protocols. Data at rest is encrypted using current-generation symmetric encryption. Encryption key management follows established best practices, including separation of key management from data storage where operationally feasible.

2.5 Regional Controls

Where enterprise agreements specify regional data residency requirements, Cognispace implements infrastructure controls to support those commitments. Regional configurations are documented in applicable customer agreements.

Access Controls

3.1 Role-Based Access Control

Access to systems, data, and administrative functions is governed by role-based access control. Access rights are assigned based on job function and operational necessity. Roles and permissions are reviewed periodically and adjusted to reflect changes in personnel, responsibilities, and organizational structure.

3.2 Least Privilege

Access is granted at the minimum level necessary to perform a legitimate function. Privileged access to production systems, customer data, and administrative interfaces requires documented justification and is subject to additional oversight and audit logging.

3.3 Multi-Factor Authentication

Multi-factor authentication is required for access to Cognispace production systems and administrative interfaces. Enterprise customers can enforce MFA requirements for their workspace users through available administrative controls.

3.4 Single Sign-On

Cognispace supports single sign-on integration for enterprise customers through standard identity federation protocols. SSO configuration is managed through enterprise administrator controls and governed by applicable security requirements.

3.5 Credential Lifecycle

Credentials are managed through defined lifecycle procedures including provisioning, rotation, and revocation. Inactive or terminated accounts are deprovisioned promptly. Emergency credential revocation procedures are maintained for security incidents.

3.6 Administrative Review

Access to sensitive systems and elevated permissions is subject to periodic review. Access that is no longer operationally justified is revoked as part of our access governance process. Review outcomes are documented for audit purposes.

Application Security

4.1 Secure Development Lifecycle

Security is integrated into our software development lifecycle from design through deployment. Security requirements are established during the design phase. Code is reviewed for security vulnerabilities prior to production deployment. Architectural changes that affect security boundaries are subject to formal security review.

4.2 Vulnerability Scanning

Cognispace maintains a continuous vulnerability identification program. Automated scanning tools assess application code, dependencies, and infrastructure configurations on a recurring basis. Identified vulnerabilities are triaged, tracked, and remediated according to severity-based timelines.

4.3 Patch Management

Security patches for operating systems, runtimes, libraries, and platform components are applied on a risk-prioritized schedule. Critical security patches are prioritized for rapid deployment. Patch status is tracked through a formal change management process.

4.4 Secrets Management

Credentials, API keys, certificates, and other sensitive configuration values are managed through dedicated secrets management systems. Hardcoding of secrets in application code or configuration files is prohibited. Secrets are rotated according to defined schedules and immediately upon suspected compromise.

4.5 Dependency Review

Third-party software dependencies are reviewed for known vulnerabilities at integration and on a recurring basis. Dependency management practices include maintaining current dependency versions and monitoring for newly disclosed vulnerabilities in integrated libraries.

4.6 Deployment Controls

Production deployments are managed through controlled release processes that include testing validation, review gates, and rollback capabilities. Unauthorized or unreviewed changes to production environments are prohibited.

Monitoring and Logging

5.1 Audit Logging

Cognispace maintains comprehensive audit logs of access events, administrative actions, data operations, and system changes across production environments. Audit logs capture the identity of the actor, the action performed, the resource affected, and the timestamp. Logs are protected against unauthorized modification.

5.2 Security Telemetry

Security telemetry is collected continuously from infrastructure, application, and network layers. Telemetry feeds are analyzed for indicators of compromise, anomalous activity, and policy violations. Security monitoring systems operate continuously.

5.3 Anomaly Detection

Automated detection systems identify abnormal patterns in access, usage, and system behavior that may indicate unauthorized activity or security incidents. Alerts generated by detection systems are reviewed by the security team according to defined escalation procedures.

5.4 Log Retention

Security-relevant logs are retained for a period sufficient to support incident investigation, forensic analysis, and applicable compliance requirements. Log retention periods are defined in Cognispace’s data retention policies and reviewed periodically.

Incident Response

Cognispace maintains a documented incident response program designed to enable rapid detection, escalation, containment, and recovery from security events. The program is reviewed and updated periodically, and team members responsible for incident response receive ongoing training.

6.1 Detection

Security incidents may be identified through automated monitoring systems, internal reports, external researcher disclosure, or customer notification. All suspected security events are treated as potential incidents until assessed and classified.

6.2 Escalation

Incidents are escalated through defined channels based on severity, scope, and potential impact. Critical incidents involving potential data exposure or service disruption are escalated to senior leadership immediately. Escalation procedures are documented and tested periodically.

6.3 Containment

Upon classification of a security incident, containment measures are implemented to limit the scope and prevent further unauthorized access or data exposure. Containment actions may include access revocation, system isolation, credential rotation, and service suspension where necessary.

6.4 Recovery

Following containment, affected systems and services are restored through validated recovery procedures. Recovery steps are documented and validated prior to resuming normal operations. Post-incident reviews are conducted to identify root cause and implement corrective controls.

6.5 Customer Notification

Where a security incident is determined to involve a material risk to customer data, Cognispace will notify affected enterprise customers in accordance with applicable contractual commitments and legal requirements. Customer-facing notifications will include available information about the nature of the incident, the data potentially affected, and actions taken or recommended.

Data Protection

7.1 Backup and Recovery

Production data is backed up on a scheduled basis using automated backup systems. Backup integrity is validated through periodic recovery testing. Backup data is encrypted and stored with access controls consistent with production data protections.

7.2 Disaster Recovery

Cognispace maintains disaster recovery capabilities designed to support service restoration following significant infrastructure disruptions. Recovery time and recovery point objectives are defined and tested. Disaster recovery procedures are documented and reviewed periodically.

7.3 Retention Alignment

Data retention practices are aligned with the Privacy Policy, applicable enterprise agreements, and governing law. Data that has reached the end of its applicable retention period is subject to deletion or secure archival in accordance with documented procedures.

7.4 Deletion Lifecycle

Data deletion requests from authorized users or enterprise administrators are processed in accordance with applicable agreements and legal requirements. Secure deletion procedures are applied to production data. Residual data in backup systems is subject to scheduled purge cycles.

7.5 Archival Controls

Archived data is maintained in access-controlled storage environments. Access to archived data is limited to authorized personnel with a documented operational or legal justification. Archived data retains the same confidentiality protections as active production data.

Vendor and Subprocessor Security

Cognispace engages third-party vendors and subprocessors to support infrastructure, operational, and service delivery functions. The security posture of our vendors directly affects our own security commitments, and we take vendor risk management seriously.

8.1 Due Diligence

Prior to engaging a vendor or subprocessor with access to customer data or production systems, Cognispace conducts a security assessment appropriate to the scope and sensitivity of the engagement. Assessment criteria include security certifications, data protection practices, incident response capabilities, and compliance posture.

8.2 Contractual Controls

Vendors and subprocessors with access to customer data are required to execute data processing agreements that establish confidentiality obligations, security requirements, incident notification obligations, and restrictions on data use. These agreements reflect the protections Cognispace commits to its customers.

8.3 Periodic Review

The security posture of material vendors and subprocessors is reviewed periodically. Reviews consider changes in the vendor’s security posture, new certifications, reported incidents, and changes in the scope of the engagement. Vendors that no longer meet Cognispace’s security requirements are subject to remediation requirements or offboarding.

Responsible Disclosure

Cognispace supports the responsible disclosure of potential security vulnerabilities by security researchers, customers, and third parties. We are committed to working collaboratively with those who identify issues in good faith to investigate and remediate them promptly.

9.1 Reporting

Security vulnerabilities or concerns may be reported to Cognispace through our designated security contact channel. We ask that reports include a description of the potential vulnerability, steps to reproduce the issue where applicable, and any relevant technical details.

9.2 Security Contact

9.3 Disclosure Expectations

Cognispace commits to acknowledging receipt of valid security reports promptly, investigating reported issues in good faith, communicating our findings and remediation timeline to the reporter where appropriate, and not pursuing legal action against researchers who report vulnerabilities responsibly and in accordance with this policy.

We ask that reporters refrain from accessing, modifying, or exfiltrating data beyond what is minimally necessary to demonstrate the issue, and from publicly disclosing vulnerability details before Cognispace has had a reasonable opportunity to investigate and remediate.