Security

1. Beta security posture

Cognora is in controlled beta. We apply practical security controls appropriate for early production use, but we have not completed a broad public-launch security program. Counsel review is required before broad public launch.

2. Authentication and access

• Web sign-in uses secure sessions and JWT-based access patterns for the API.
• The browser extension uses per-device pairing tokens validated server-side.
• Admin and billing catalog surfaces require appropriate admin authorization.
• API routes enforce authentication for account, workspace, billing, and recall operations.

3. Data separation

• Personal memory is scoped to your account.
• Workspace memory is available only to verified workspace members through membership-checked recall paths — not from unverified cookies alone.
• Meeting content in Postgres is the canonical record; semantic recall indexes are isolated by session scope.

4. Infrastructure

Cognora runs on cloud infrastructure with managed database, cache, and object storage. Production is served at cognora.tauq.me. We use industry-standard transport encryption (HTTPS) for data in transit. We do not publish detailed architecture diagrams on this page.

5. Integrations

Google Calendar, Slack, and Notion access only what you connect and authorize. Integration tokens are stored and used server-side; they are not exposed in client bundles.

6. Payments

Razorpay handles payment collection. Cognora stores subscription or pass status and payment references needed for billing — not full card numbers.

7. What we do not claim

We do not claim SOC 2, ISO 27001, HIPAA compliance, formal penetration testing, bug bounty programs, or third-party security audits in this beta.

8. Responsible disclosure

If you believe you have found a security vulnerability, email getcognora@gmail.com with:

• A clear description of the issue and steps to reproduce.
• The affected URL or component, if known.
• Your contact information for follow-up.

Please do not:

• Access data that is not yours.
• Disrupt production services or other users.
• Publicly disclose issues before we have had a reasonable time to investigate.

9. Related documents

• Privacy Policy
• Terms of Service
• Data Processing Agreement
• Non-Disclosure Agreement