Security

1How Cognos is built

Three parts work together every time you chat, and each is trusted with as little as possible.

• Your device holds the keys. Your chats are unlocked and read here, and nowhere else.
• Our servers store your chats locked, pass your message to the AI, and lock the answer away again. They never keep a copy we can read.
• The approved AI provider receives your message while it answers. We disable Provider retention and verify that setting before approval.

2How your chats are locked

When a conversation is saved, it’s locked on your device before it reaches us — the messages, titles, summaries and any files. We store only the locked version, which we can’t read.

Only your key can open it again, and that happens on your device when you sign in.

3Your key and your password

You have two separate secrets, each with one job:

• Your password signs you in. Forget it and you can reset it by email — your chats stay safe, because the password doesn’t unlock them.
• Your Account Key is the one that opens your chats. We never receive it or store it, so keep it somewhere safe. If you lose it, we can’t recover your chats for you — that’s the trade-off for keeping no copy we can read.

4What we can and can’t see

We can see the details needed to run the service — your account and billing information, which model you used, and technical details like timestamps. While the AI is answering, your message is readable so the AI can work with it.

We can’t read your saved chats, titles, summaries, memory or files from storage. They stay locked with a key we don’t hold.

Before your message leaves your device, Cognos also hides common personal details — like emails, phone numbers, bank details and ID numbers — behind placeholders, so the AI works with placeholders instead of the real values.

5Where your data is handled

Cognos is run by a Swiss company. The app and its stored data are hosted in Europe, and you choose whether AI models run in Switzerland only or across Europe.

We keep data only as long as we need it. Your chats stay until you delete them, they expire, or you close your account. Deleted items are held briefly in a recovery snapshot before they’re gone for good, and backups rotate on a regular schedule.

6Who helps us run Cognos

A short list of specialist providers helps us host the app, send emails, take payments and provide the AI. Most only ever handle data in a form we can’t read.

See the full list — who they are, what they handle and where — on the Subprocessors page.

7Independent review

The parts of Cognos that handle your data are open for inspection, so you can verify what we do rather than take our word for it.

Cognos hasn’t yet completed a formal independent security audit. We’ll say so here plainly when that changes.

8What this doesn’t protect against

We’re upfront about the limits:

• While the AI answers, your message has to be readable to our systems and the AI provider. This is the one moment it isn’t locked, and it’s never kept afterwards.
• Hiding personal details is automatic but best-effort — it catches common things like emails and card numbers, not everything.
• If someone reaches your device while it’s unlocked, they can see what you can see. Locking or signing out protects a device you’ve stepped away from.
• If you lose your Account Key, your chats can’t be recovered.

Cognos is built to protect your saved chats if our storage or database is ever breached — not to hide your message from the AI while it’s answering.