Security
Last updated: 20 September 2026
This page is under final legal review and may be updated before it is finalised.
Security and privacy are built into how Cogent² (Cogent2 Limited) is designed and operated. This page summarises the main measures we take to protect your data. It sits alongside our Privacy Policy, Data Processing Agreement and Sub-processors.
Data minimisation by design
Our integration platform does not persist raw customer payload data. Incoming data passes through a redaction pipeline that strips credential-shaped and PII-shaped fields before anything is stored, we observe the structure of data only and never its values. What we send to our AI provider is a separate question and is governed on a different basis: credentials are never sent, and whole payload bodies are never sent, but the assistant does work with your own order and fulfilment references, run ids, statuses and error text, because a diagnostic tool that anonymises the reference you just asked about cannot answer you. Any account can have that switched off entirely. Your own integration code is also sent when someone asks us to explain or review a flow, and one NetSuite script file when a user clicks for a description of it, because describing logic requires the logic; secrets are stripped from those bodies when we first read them. A personal name or postal address written into free text is not reliably detectable by automated means and may not be removed. Files handled by our EDI service are necessarily stored whole to be validated, translated and delivered, and are protected by encryption, access control, and automatic deletion on a rolling 30-day basis.
Encryption
Data is encrypted in transit using TLS. Data at rest is protected by our hosting providers' managed encryption, and sensitive credentials such as per-account integration keys are additionally encrypted at rest using authenticated encryption with managed key rotation.
Access control and tenant isolation
We enforce role-based access control with least-privilege roles. Account scoping keeps each customer's data isolated so one account cannot access another's, and this isolation is verified with automated tests as part of our development process. Administrative access is restricted and can be protected with multi-factor authentication.
Hosting
We host our application and database in the EU region (Railway and Supabase), and our EDI file storage in the Amazon Web Services EU region. Our full list of sub-processors, with their purpose and location, is on our Sub-processors page.
Artificial intelligence
Where our AI features process content, that content is used only to generate your response. We have no arrangement that would permit our AI provider (Anthropic, PBC) to train its models on it. We put it that way deliberately: that is our reading of the terms we contract on rather than a countersigned clause we can hand you, and we would rather be precise now than have you find the difference later. Personal data from your connected systems that passes through our integration platform is redacted as described above before storage.
We can tell you exactly what leaves. Every AI call the platform makes is declared in an internal register that is checked against the running code, so it cannot quietly fall behind what the software actually does. There are forty-one such surfaces today. Ask us and you get the list: what each one sends, why it sends it, and the limit we accept on each.
Plenty of vendors will tell you they never send your data anywhere. We would rather tell you exactly what we send, why, and how to turn it off. The first is easier to say. The second is the one you can check.
How the platform learns
The platform improves by learning how integrations fail and how they are repaired: how third-party systems behave, what causes a failure, and which configuration resolved it. What we learn from one customer's integrations is applied for the benefit of all of them, including yours. It is why the platform is worth more after a year of running your integrations than it was on the day you connected.
That shared knowledge records the engineering, not your content. It does not include payload contents, credentials or personal data, and identifiers of those kinds are removed before a record is created. Before a record is made available to another customer it goes through a further removal of identifiers, which covers the names of customers, their users and the objects they build, and a person reviews each record before it is shared. As with any automated redaction we describe this as thorough rather than guaranteed, and we will remove any record you identify as carrying your information, on notice and at no charge.
If you would rather contribute nothing, tell us in writing and we will comply within thirty days. You keep the benefit of what every other customer's operations have taught the platform. This is set out in clause 2.6A of our Master Services Agreement.
Certifications of our providers
Our platform is built on established infrastructure and integration providers that maintain recognised security certifications. Patchworks, the integration platform behind the Cogent² Platform, maintains ISO 27001 and SOC 2, and our cloud providers maintain their own certifications. Cogent² itself is not currently independently certified to those standards; where a customer needs formal assurance, we can share the relevant provider reports and answer a security questionnaire.
Monitoring and resilience
We log and monitor platform operations, alert on integration failures and suspicious activity, and maintain back-ups and documented recovery processes for platform data.
Sub-processors
We engage a small number of sub-processors under data-protection terms, and give customers at least 30 days' notice before adding or replacing one. The current list is on our Sub-processors page.
Insurance
We maintain appropriate professional indemnity and cyber-liability insurance for a business of our size and activities.
Reporting a vulnerability
If you believe you have found a security vulnerability, please tell us at privacy@cogent2.com so we can investigate. Please give us a reasonable opportunity to respond before any public disclosure, and do not access, modify or delete data that is not your own.
Contact
For security or privacy questions, contact privacy@cogent2.com.