Your data is safe with us
Security isn't an afterthought — it's built into every layer of Kognit's architecture. From encryption at rest to encrypted credentials and signed webhooks, we take your trust seriously.
Security practices
How we protect your data at every layer.
Encryption in transit and at rest
All traffic uses TLS. Data at rest is encrypted by Google Cloud and AWS (AES-256), and store and channel access tokens are additionally encrypted by Kognit.
Encrypted credentials
Connection tokens for Shopify, Meta and WhatsApp are encrypted before they are stored and are never sent to the browser.
Privacy by Design
We collect only the minimum data required to operate. No data is ever sold to third parties. Full data portability on request.
Certifications — coming soon
ISO 27001 and SOC 2 Type II audits and an independent penetration test are planned. We are not certified yet and will publish reports when they are complete.
OAuth 2.0 Integrations
Platform connections (Meta, Shopify, Google, Microsoft, Wix) use OAuth. Incoming webhooks are signature-checked and refused when unsigned.
Privacy requests
We handle data access and deletion requests, including Shopify customer-data and redaction requests, as GDPR and CCPA require.
Infrastructure security
The technical foundation that keeps your data protected.
Google Cloud & Firebase
The app runs on Google Cloud (Firebase). The database is hosted in Mumbai, India.
Firebase Security Rules
Role-based access controls enforced at the database level.
Private file storage
Photos and files are kept in a private, encrypted bucket and served only through signed links.
Daily backups
The full database is backed up every day and kept for 90 days, with a tested restore procedure.
Access control
Roles and permissions per teammate, SSO/SAML sign-in, and admin access limited to verified accounts.
Secrets Management
All secrets stored in Google Secret Manager with restricted access.
Security timeline
Recent milestones in our security program.
ISO 27001 and SOC 2 Type II audits; independent penetration test.
All incoming webhooks (Shopify, Meta, Wix, email) signature-checked and refused when unsigned.
Admin access limited to verified accounts, with an admin activity log.
Customer photos and files moved to private, encrypted storage; daily database backups with 90-day retention.
Responsible Disclosure
Found a vulnerability? We appreciate responsible disclosure and will work with you to resolve any issues promptly. We do not pursue legal action against security researchers who report in good faith.
support@kognithq.com