Information Security Program

Cognism has dedicated security and compliance teams. Incident management is owned and operated by our security team.

• Encryption:

  Data is encrypted in transit and at rest. HTTPS is enforced using TLS 1.2 and TLS 1.3. Data at rest is protected using AES-256. AWS Key Management Service is used to manage encryption keys.

• Segmentation: 

  Customer data is logically segregated across Cognism products.

• Backup and Recovery: 

  Backups are automated, with recovery procedures tested quarterly. Recovery point and recovery time objectives are set to 24 hours.

• Retention and Deletion:

  Customer data is retained only as long as necessary and deleted following contract termination.

Cognism follows a structured Software Development Life Cycle (SDLC) with security integrated throughout.

• Secure Development: 

  Code coverage, security testing, code quality, dependency tracking, and SAST.

• Secure Build: 

  Automated build processes with dependency tracking.

• Secure Deploy: 

  Controlled change management with multiple approvers.

• Secure Runtime:

  Infrastructure monitoring, alerting, reporting, and use of IDS and IPS tooling.

Cognism maintains separate environments for testing, staging, and production.

Access is granted based on least privilege and need-to-know principles.

• Background Checks:

  Background checks are conducted prior to employment, in line with local laws and regulations.

• Workforce Training:

  All employees complete security training during onboarding, with annual refresher training.
  Role-specific technical training is provided where required.

• Penetration testing:

  Independent third-party penetration testing is conducted at least annually across products and infrastructure.

Cognism maintains infrastructure and processes to support service availability and resilience:

• Public status page for system transparency
• AWS-hosted infrastructure
• Cloudflare DDoS protection and WAF
• Industry-standard disaster recovery and business continuity practices

Cognism maintains cyber security insurance covering data, crisis containment, property, and liability.

Privacy Policy
Your data remains yours.
Details on data collection, usage, and opt-out are available below:

• Cognism Privacy Policy
• Cognism Data Opt-Out