Security you can check.
Security and sovereignty are design constraints we hold from the first commit, and most of them run as CI gates. There is no closing phase.
Compliance. Product. Infrastructure. Operations.
Compliance
The questionnaires procurement and security teams ask for: typed, maintained, and requestable from the document library. Each is completed and carries its review date.
Certification questionnaire
CAIQ v4
Cloud Security Alliance Consensus Assessment, completed for our stack. The standard cloud-security questionnaire.
Certification questionnaire
SIG
Shared Assessments Standardized Information Gathering questionnaire. Third-party risk, answered in full.
Certification questionnaire
HECVAT Full
Higher Education Community Vendor Assessment Toolkit, for university procurement and research offices.
Product
What the software itself enforces, on every request.
Models
Zero-retention
No training on your data, no retention by model providers. Inference runs and leaves nothing behind.
zero-retentionAccessibility
WCAG 2.2 AA
Accessibility is gated in CI rather than audited at the end. Everything we ship clears AA contrast and interaction.
axe + contrast · CIInfrastructure
Where systems run and how tenants are kept apart.
Data residency
Onshore, always
Every system runs in-country on AWS Sydney. Your data never leaves the jurisdiction.
ap-southeast-2Tenant isolation
Row-level security
Isolation is enforced in the database, below the application, and proven by a harness on every CI run.
pgTAP harness · CIOperations
How every change ships.
Supply chain
Signed provenance
SLSA build provenance and a signed SBOM, verified in-CI. You can check exactly what shipped.
SLSA · SBOMApp security
Scanned continuously
Static analysis and secret scanning on every change: CodeQL, Semgrep, and gitleaks gate the build.
SAST · secretsEvery artifact, listed.
Public documents open directly. Gated ones arrive by email once we know who’s asking. No artifact routes to a generic contact form.
CAIQ v4 questionnaire
Cloud Security Alliance Consensus Assessment, completed for our stack.
SIG questionnaire
Shared Assessments SIG: the standard third-party risk questionnaire.
HECVAT Full questionnaire
Higher Education Community Vendor Assessment, for university procurement teams.
Isolation white paper
How row-level isolation is enforced at the database and proven by a CI harness.
Due-diligence intake
Our structured due-diligence intake. Send yours, or start from ours.
Sovereign reference architecture
How a sovereign build is put together: local open-weight inference, a client-owned data plane, and air-gap options.
Subprocessor register
Every third party that touches client data, with purpose and region.
RLS isolation harness result
The tenant-isolation harness result, written to the database on every CI run.
security.txt
Responsible-disclosure contact and policy, machine-readable at the standard path.
Request a gated artifact
Tell us who you are and which document you need. We’ll send it over. NDAs welcome.
The gates run on every build.
Most trust pages list aspirations. Ours points at checks that pass or fail on every commit: quality, isolation, supply-chain, and security gates, plus a tenant-isolation harness that writes its verdict to the database. No badge images. The tooling behind the gates is going public as licence reviews clear; install what is published and run it on your own code.
What we don’t claim yet
SOC 2 and ISO 27001 are on our roadmap, not our wall. Until an auditor signs, what you get are the controls themselves: RLS-forced tables, zero-retention model calls, and a validation gate on every commit, plus the completed questionnaires above.
- Quality gatetsc · RLS · a11y
- ProvenanceSLSA · SBOM
- CodeQLSAST
- SemgrepSAST
- gitleakssecret scan
- Lighthouseperf budgets
The same checks run as a fixed-scope review. The RLS review ›
Who touches the data.
The complete list: purpose and region stated plainly, including the ones that aren’t onshore.
| Subprocessor | Purpose | Region |
|---|---|---|
| Supabase | Database, auth & storage | ap-southeast-2 (Sydney) |
| AWS | Infrastructure underlying Supabase | ap-southeast-2 (Sydney) |
| Vercel | Hosting & CDN | Global edge · US compute |
| Anthropic | AI inference (zero data retention) | US |
| Stripe | Billing | US · global |
| Resend | Transactional email | US |
| Sentry | Error monitoring | US |
| Deepgram | Voice transcription | US |
What changed, and when.
Sovereign reference architecture
Sovereign reference architecture added to the document library (request access), backing the sovereign offering published at /what-we-build.
Trust centre launched
Document library, subprocessor register, dated updates feed, and the responsible-disclosure route published at /trust and /.well-known/security.txt.
Isolation badge made public
The RLS isolation harness result became publicly readable through a definer RPC (trust_badge_public). Live proof without a staff session.
Public intake hardened
Marketing contact submissions moved to a SECURITY DEFINER intake RPC with per-IP rate limiting; the leads table has no anonymous write policy.
Spotted something? Tell us.
Found a vulnerability in anything we run? Email us directly. No forms, no triage bots. We acknowledge reports within three business days, keep you informed through to resolution, and credit good-faith research if you want the credit.
- Contact
- info@cogveralabs.ai
- Acknowledged within
- three business days
- Machine-readable
- /.well-known/security.txt
Bring us the work. We’ll bring the governance.
Two hours, your team, the real work. Everything on this page ships with it.