Encryption Everywhere
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database backups and file storage use server-side encryption with managed keys.
Security & privacy
Your intelligence,
protected.
Cognuum is built for professionals who demand confidentiality. Here is how we protect your data, your research, and your privacy.
Authentication & Access
Supabase Auth with Row Level Security (RLS) enforces per-user data isolation at the database layer. Every API endpoint validates JWTs before processing.
Privacy by Design
We collect only what is necessary to deliver the product. No analytics trackers, no third-party ad pixels. Your research and portfolio data are never sold or shared.
AI Data Handling
Prompts sent to LLM providers are governed by commercial API terms that prohibit training on inputs. OpenAI conversation storage is disabled on every call. No user-identifying metadata is passed to inference endpoints.
Infrastructure Security
Hosted on SOC 2-compliant infrastructure. Network-level firewalls, automated vulnerability scanning, and immutable deployments protect the platform.
Regular Penetration Testing
Independent security researchers conduct penetration tests through our Cobalt.io program. Findings are triaged and remediated on a continuous basis.
How we handle your data
Every layer of the stack enforces isolation and access control — from the network edge to the database row.
Row Level Security
Every database query is scoped to the authenticated user via Postgres RLS policies.
Defence in Depth
Edge functions enforce auth checks independently of database policies — no single point of failure.
CORS Controls
Strict origin allowlists on every API endpoint — no wildcard origins.
Least Privilege
Service roles are scoped to the minimum permissions required for each function.
Subprocessors
Third-party services that process data on our behalf. We vet each provider for security practices and data handling commitments.
Provider
Purpose
Location
Privacy
AI & your data
Cognuum uses multiple AI providers to power its intelligence features. Here is how we protect your data across all of them.
- Your prompts and context are sent via API — never through consumer-facing chat products
- No LLM provider uses your data to train or fine-tune models
- Provider commercial terms prohibit training on API inputs; OpenAI conversation storage is disabled on every call
- Sensitive identifiers (emails, user IDs) are stripped or anonymised before reaching inference endpoints
- All AI calls are gated by authentication — no anonymous access to inference
Report a vulnerability
If you believe you have found a security vulnerability in Cognuum, we encourage responsible disclosure. Please contact us directly — do not open a public issue.
Related policies