Infrastructure security
- Runs on GCP and Vercel (US / EU regions)
- AES-256 encryption for all data at rest
- Encrypted in transit with TLS 1.2 or higher
- Production isolated from development and staging
Access our compliance documentation, review our security controls and subprocessors, and see exactly how CognitiveClouds and Cortex protect your code and data. Guarantees are enforced by the system — not promises we ask you to take on faith.
Controls
Access & identity
- SSO/SAML and OIDC supported
- Read, suggest, approve, deploy are separate privileges
- MFA strictly required for all employees, admins, and any production or customer-data access
- Least-privilege internal access: role-restricted, granted via temporary support-ticket sessions, heavily logged, and auto-revoked
Agent sandboxing
- Agents execute in isolated, sandboxed workspaces
- No reach to production or other customers' environments
- Scope enforced at the platform level, not by prompt
Assessment scanning
- Cortex analyzes code structure, dependency graphs, and documentation only
- Explicitly ignores .env files and .git commit history
- Exposed secrets and API keys are automatically redacted
- Strictly read-only access — your code is never modified
Data use & retention
- Your codebase, proprietary data, and telemetry are never used to train our own or third-party foundation models
- Repository data accessed during an assessment is retained for 30 days, then permanently deleted
Accountability & audit
- Every agent action ties to a delegated identity
- Every human approval is recorded
- Audit log answers “who, really?” — never “the AI did it”
Incident response & disclosure
- Customers notified within 72 hours of a confirmed incident materially affecting their data
- Responsible vulnerability disclosures acknowledged within 24 business hours
Data collected
- Account administrator information (name, work email, company)
- Repository metadata analyzed during an assessment
- Authentication tokens
- Platform usage telemetry (security & analytics)
- Credit card information (processed securely via Stripe)
- Personal health information (PHI)
- Personally identifiable information of your end-users
Subprocessors
Google Cloud Platform
US / EUCore cloud infrastructure and secure data hosting.
Vercel
GlobalFrontend application hosting and edge network delivery.
OpenAI
USAI model inference via Enterprise API, under a strict zero-data-retention policy for training.
Anthropic
USAI model inference via Enterprise API, under a strict zero-data-retention policy for training.
Pinecone
USManaged vector database for agent memory.
LangSmith
USLLM observability and trace evaluation.
Stripe
USSecure payment and subscription processing.
FAQ
Is the Agent Readiness Assessment read-only?
Yes. We request read-only access to the specific repository you designate — never write access, and never repositories you haven't explicitly included. You can revoke access at any time.
Do you use our code to train models?
No. We require strictly read-only access, we never modify your code during an assessment, and we never use your codebase, proprietary data, or telemetry to train our own or any third-party foundation models.
How long is repository data retained after an assessment?
Repository data accessed during an assessment is securely retained for 30 days after the report is delivered — for reporting purposes — and is then permanently deleted from our systems.
How do I get your DPA?
Our Data Processing Agreement is available on request. Ask from the Resources panel or email security@cognitiveclouds.app.
Updates
Trust Center published
Published July 3, 2026
Launched the CognitiveClouds Trust Center with our security controls, data-handling practices, compliance status, and full subprocessor list.
Security
security@cognitiveclouds.appPrivacy
security@cognitiveclouds.appData Protection
security@cognitiveclouds.app