Skip to main content
For how Cogno protects your data — storage location, encryption, AI processing and retention — see the Security overview. Protect your account with two-step verification, make it mandatory for everyone in a Business workspace, and review who exercised privileged permissions in the audit log.

​
Prerequisites

  • An authenticator app (Google Authenticator, 1Password, or similar) for two-step verification.
  • A Business workspace and an admin or Owner role to require MFA workspace-wide.
  • An admin or Owner role to read the audit log.

​
Set up two-step verification

Two-step verification is per account and applies wherever you sign in.
1

Open your account security settings

Open Settings → Account and find the Security section with the Two-step verification row.
2

Enable and scan the QR code

Select Enable. In Set up two-step verification, scan the QR code with your authenticator app. If you can’t scan it, enter the setup key manually.
3

Verify the first code

Enter the 6-digit code from your app under Verification code and select Verify. Cogno confirms with Two-step verification enabled.
From then on, signing in shows a Two-step verification screen asking for the 6-digit code from your authenticator app before you can continue to Cogno.

​
Disable two-step verification

In Settings → Account → Security, select Disable on the Two-step verification row, then confirm in the Disable two-step verification? dialog. Your account will no longer require an authenticator code when you sign in.
If a workspace you belong to requires MFA, disabling two-step verification locks you out of that workspace until you enable it again.

​
Require MFA for a workspace

On the Business plan, admins and Owners can make two-step verification mandatory for every member.
1

Verify your own MFA first

Set up and verify your own two-step verification before requiring it for everyone — the toggle stays disabled until you have.
2

Turn on the requirement

Open Settings → Security and turn on Require MFA for this Workspace.
The policy applies to every workspace member:
  • Members who already use two-step verification are asked for their code when they sign in, as usual.
  • Members who have not set it up are sent to their Account settings to enable it before they can enter the workspace.
On a Free workspace the toggle is disabled with the note This setting is available on the Business plan — see Manage workspace billing to upgrade.

​
Restrict Tasks to their assignee’s Computers

Admins and Owners can turn on Run Tasks only on the assignee’s Computers in Settings → Security. The setting is off by default. Ask Cogno whether this restriction is on to check the current workspace setting. When enabled, Tasks wait for a Computer owned by their current assignee. Tasks without an assignee also wait. Other members’ Computers and Cloud cannot run those Tasks, including through manual Computer selection. Register a Project folder on the assignee’s Computer and keep that Computer online to let the Task run. The restriction is checked again when a run starts or renews its authorization. A run on a Computer that no longer satisfies the policy loses authorization at the next check.

​
Choose what Cogno may change for you

Ask Cogno in a conversation or a chat thread to change a setting — “turn off meeting recording”, “invite ken@acme.co”, “make this Project read #design too” — and it changes it with the same rules the Settings screens apply, as you. It can only do what you could do yourself, and it records your words with every change in the audit log. Admins and Owners choose, per group, whether Cogno may do this freely, must ask first, or never:
  • Settings → General → Agent tools: Change workspace settings, Change Project settings, Change integration setup, Import GitHub issues as Tasks, Change personal preferences and Change computer settings.
  • Settings → Members → Agent tools: Change member roles and Invite and remove members.
Pick Block, Ask or Allow for each. Invite and remove members and Import GitHub issues as Tasks start at Ask; the others start at Allow. Changes take effect on the next run. Some settings Cogno never changes, whatever you choose: two-step verification and the MFA requirement, API keys and other credentials, billing, deleting a workspace, account or Project, connecting or disconnecting an integration, and anything that would give Cogno’s own runs more access. Ask about one of these and Cogno tells you where it is and how to change it yourself.

​
Review the audit log

Open Settings → Security → Audit log to see privileged actions in the workspace, newest first. The entry is visible to admins and Owners only. Each entry shows:
  • The permission that was exercised (for example, creating or revoking an API key, changing member roles, or managing execution environments).
  • Who acted — a member name, via machine for actions taken through an enrolled machine, or via service for Cogno’s own service actions.
  • A summary of the target (the key details of what was changed).
  • The timestamp.
The initial period covers the most recent seven UTC dates, including today. Select Load more to page further back within the applied period.

​
Download a CSV

1

Choose the period

Set Start date (UTC, inclusive) and End date (UTC, exclusive), then select Apply period. For October 1 through October 7, use October 1 and October 8. The list and CSV use this same period.
2

Download the records

Select Download CSV. The file includes every matching entry from a snapshot taken when the export starts, including entries not loaded on screen. Empty periods produce a file with column headers only.
In the macOS Desktop app, the CSV is saved in your Downloads folder. Repeated downloads keep separate files. Each export allows up to 31 days, 10,000 entries, 10 MiB per file, and 16 KiB per field. If a limit is exceeded, no partial CSV is downloaded. Choose a shorter period; a field larger than 16 KiB cannot be exported. If preparation takes longer than 30 seconds, choose a shorter period and retry. The UTF-8 CSV includes a BOM for Japanese text in spreadsheet apps, quoted cells, UTC timestamps, actor identifiers, permission, outcome, and selected target identifiers (such as Task, Project, member, machine, environment, work and API key IDs). It excludes arbitrary target details, metadata and content bodies. Potential spreadsheet formulas are prefixed with an apostrophe so they are treated as text. CSV records are ordered by timestamp, then ID, newest first. Actor names and other display summaries are not included.

​
Troubleshooting

For anything not listed here, see Troubleshooting.