Security
How we protect the platform and your staff’s data
Cogniria’s security controls, how we review them, and the documentation you can ask us for when assessing us as a supplier.
We reviewed the code before opening it to customers
In August 2026 we carried out a white-box audit of the whole platform: the server, the web application and the deployment. We found 43 points for improvement, none of them critical, and documented what was done about each one in a remediation report.
Before that, in July 2026, we reviewed it against the OWASP Top 10 web risks, with a technical report and an executive summary.
Both audits were carried out by our own team. You can ask us for the executive summaries under a non-disclosure agreement.
Platform controls
Two-step verification
Everyone can turn on a second factor with an authenticator app (TOTP). The secrets are stored encrypted with AES-256-GCM.
Protected passwords
They are stored with bcrypt and a complexity policy. Changing your password signs out your other open sessions.
Each company kept apart
Each company’s data sits in its own space in the database, isolated from the others.
Attempt limits
Sign-in and two-step verification limit attempts to slow down brute-force attacks.
Activity log
Relevant administrative actions are logged so they can be audited later.
Encrypted connections
All traffic goes over HTTPS with HSTS, and in production the database connection verifies the server’s certificate.
Reporting a vulnerability
If you find a security flaw in cogniria.com or in the platform, write to us with a description and the steps to reproduce it. We will reply and coordinate the fix with you.
Contact details in the standard format (RFC 9116)For your supplier assessment
If your company assesses its suppliers, we can share the executive summaries of the audits under a non-disclosure agreement and answer your security questionnaire.
Request documentationBook a demo
A 20–30 minute session. We’ll get back to you within 24 business hours.
In the demo you’ll see…
- The compliance report, live
- The course catalogue with audio
- A managed phishing campaign
- How the evidence is exported
[email protected]