Skip to main content
This page is for the people who approve Cogno for their company: IT, information security and procurement. It explains where your data lives, what runs on your own computers, how access is controlled, how AI processing works, and how data is deleted. For step-by-step setup of two-step verification and the audit log, see Secure your workspace. In this page, your data means what your team enters or uploads to Cogno and what Cogno fetches from services you connect.

​
Shared responsibility

​
Where your data is stored

Some supporting services process limited data outside Japan: web hosting access logs, error monitoring, product analytics, email delivery, billing and mobile push notifications. The subprocessor list names each one, the data it handles and where.

​
What runs on your computers and what runs in Cogno

Cogno has two parts: The Engine connects out to Cogno over HTTPS; see Use Cogno behind a corporate proxy for the hosts to allow. A Remote Server accepts no inbound network connections — Cogno Desktop reaches it only through your SSH tunnel. The Engine signs in with its own machine credential, separate from any member’s sign-in. Cogno stores only a hash of that credential. Removing a machine in Settings revokes its credential immediately. You also choose how much an agent may do on each machine — see Control access during agent runs. A Workspace can also use Cloud, a managed environment where Cogno keeps working while your computers are off. Cloud is optional.

​
Integrations and permissions

  • Cogno reads from and acts in an external service only within the access you approve when you connect it.
  • Each Project chooses which connected sources and repositories it uses, and Project tool permissions cannot exceed the Workspace’s.
  • Disconnecting a service stops new reads and actions in it. Data fetched from it is deleted on the schedule described for that integration.
  • Cogno does not use data from connected services for any AI model training, with or without consent.
Each integration page lists the permissions it requests and what happens on disconnect — for example Slack. See all integrations in Integrations.

​
Sign-in and access control

  • Sign-in: email and password, Sign in with Google, or Sign in with Apple. Passwords are stored only as hashes by the authentication service, never in plain text.
  • Two-step verification: any member can protect their account with an authenticator app.
  • Required MFA: on the Business plan, admins and Owners can require two-step verification for every member of the Workspace.
  • Roles: every member has one role — Viewer, Member, Admin or Owner — and every request is checked against it. Someone who is not a member of a Workspace cannot reach its data.
  • API keys: shown once at creation, stored only as hashes, and revocable at any time. See Manage API keys.
  • Cogno’s own changes: Cogno changes settings only with the requesting member’s permissions, and admins choose per group whether it may do so freely, must ask, or never.
See Secure your workspace to set these up.

​
AI processing

Cogno uses generative AI in two ways: Cogno does not use your data to train or improve AI models. Under the Amazon Bedrock service terms, Bedrock inputs and outputs are not shared with the model provider and are not used to improve base models. Audio transcription for Capture on mobile, an experimental feature, uses Google Gemini outside Japan. The subprocessor list describes this route.

​
Encryption and secrets

  • Connections from your browser, apps and Engine to Cogno use TLS 1.2 or higher.
  • The application reaches the database only over encrypted connections.
  • The database, files and backups are encrypted at rest.
  • Private files are delivered through short-lived signed URLs.
  • Service secrets are kept in Google Cloud Secret Manager.
  • API keys and machine credentials are stored only as hashes.

​
Retention and deletion

An Owner can delete a Workspace in Settings → General → Delete workspace. If the Workspace has a Business subscription, Cogno cancels it first; if the cancellation fails, nothing is deleted. Once deletion completes, the Workspace’s data is removed from the primary database. Backups are not edited record by record; deleted data leaves them as older backups expire. To take your tasks with you first, see Export tasks.

​
Backup and recovery

  • The primary database runs as a high-availability pair across separate zones in the Tokyo region.
  • Cogno keeps the 21 most recent daily backups, stored in the Tokyo region.
  • Point-in-time recovery covers the last 7 days.
  • The database has no public IP address; it is reachable only from Cogno’s private network.

​
Audit log

Cogno records privileged actions — role changes, API key creation and revocation, execution environment changes and more — with the time, who acted, the target and the outcome. Admins and Owners can read the log and download it as CSV in Settings → Security → Audit log. See Review the audit log.

​
Incident response

When Cogno detects a security incident, it confirms the scope, contains it, investigates the cause, recovers and prevents recurrence. If your data is affected, Cogno notifies you with the scope, cause and remedial measures, with a target of within 72 hours of discovery, and follows any legal reporting deadlines that apply.

​
Report a security issue

Email privacy@cogno.studio with a description of the issue and the steps to reproduce it. The same address handles security questionnaires and requests for a data processing agreement.

​
Subprocessors

Cogno uses Google Cloud, Supabase and Amazon Web Services to run the service, plus providers for web hosting, monitoring, email, meeting recording and payments. Each receives only what its function needs. The full list, with the data each handles and where, is at cogno.studio/subprocessors. Certifications held by these providers belong to them; they are not certifications of Cogno.