> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cognee.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Data Protection

> How Cognee Cloud isolates, encrypts, and protects your data — and why your data is safe with us.

Cognee Cloud is a managed, multi-tenant knowledge-graph platform. This page
describes the technical controls that protect your data today. We describe what
we actually do — not aspirations. Where we do **not** yet hold a formal
certification, we say so plainly.

***

## In one paragraph

Every customer runs in a **physically separate database and an isolated network
boundary** — not a shared table with a `tenant_id` column. Data is **encrypted
in transit and at rest**, secrets never live in source code, and each tenant's
workload holds only the credentials for its own data and nothing else. Your data
is stored on managed infrastructure with **automated backups and point-in-time
recovery**, so a bad deploy, an accidental deletion, or hardware failure does not
mean data loss. We are a German company (Topoteretes UG, Berlin) with a named
Data Protection Officer and a GDPR-aligned privacy program.

***

## 1. Tenant isolation — your data is physically separate

Cognee Cloud does **not** use shared-table multi-tenancy. Each tenant is isolated
at three independent layers:

| Layer                             | What it means for you                                                                                                                                                                                                                                                                                                                         |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Dedicated database per tenant** | Each tenant is provisioned its own dedicated managed Postgres project — holding *all* of that tenant's durable state (relational data, vector embeddings, and the knowledge graph). Your data does not share a database, schema, or table with any other customer.                                                                            |
| **Dedicated network namespace**   | Each tenant runs in its own isolated Kubernetes namespace. A default-deny **network policy** blocks all inbound traffic except from within the tenant's own namespace and from our control plane. One tenant's workload cannot open a network connection to another tenant's workload.                                                        |
| **Least-privilege credentials**   | A tenant's application pod holds **only** the password to its own database. It has no platform API keys, no cloud-provider credentials, and no cluster permissions (no Kubernetes RBAC). Even in the unlikely event a single tenant's workload were compromised, it has no path to reach another tenant's data or the platform control plane. |

**Blast radius by design.** Because isolation is enforced by separate databases
and network boundaries — not by application code correctly filtering a shared
table — a bug in application logic cannot leak one customer's data to another.
Database access can additionally be restricted by IP allow-list to our
infrastructure's egress addresses only.

***

## 2. Encryption

|                               | Control                                                                                                                   |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **In transit (you → Cognee)** | All public endpoints are served over **HTTPS/TLS**.                                                                       |
| **In transit (internal)**     | Application-to-database connections **require TLS** (`ssl: require`); a plaintext database connection is refused.         |
| **At rest**                   | Durable data is stored on managed Postgres infrastructure that **encrypts data at rest**. Backups are likewise encrypted. |

***

## 3. Authentication & access control

* **Authentication** is handled by **Auth0** (Okta). Every API request is
  validated against a signed Auth0 JWT — there is no unauthenticated access to
  tenant data.
* **API keys** are scoped per tenant and can be rotated.
* **Platform secrets** (database credentials, provider keys) are stored in **AWS
  Secrets Manager** and synced into the cluster at runtime via the External
  Secrets Operator. They are **never committed to source control** and never
  exposed to tenant workloads.
* Provider/API keys are **scoped per environment**, so a credential used in a
  development environment can never touch production data.

***

## 4. Why we won't lose your data

Data durability is engineered, not assumed:

* **Managed Postgres with automated backups.** Both the platform control-plane
  database and every per-tenant database run on managed Postgres with
  **continuous automated backups and point-in-time recovery (PITR)** — we can
  restore to a specific moment before an accidental deletion or a bad change.
* **No-data-loss migrations.** When we move or upgrade critical databases, the
  process is gated on **verified, row-count-checked copies**, the original is
  kept fully intact until a bake period passes (instant rollback), and an
  independent backup artifact is retained in object storage. Migrations that
  cannot prove an exact copy do not proceed.
* **Infrastructure recovery.** Workloads run on Amazon EKS (Kubernetes) and are
  automatically rescheduled on node or pod failure; durable state lives in the
  managed database layer, not on ephemeral pod storage.

***

## 5. Where your data is processed (sub-processors)

Cognee is a knowledge-graph platform: to build a graph from your content, that
content is processed by a third-party large-language-model inference provider.
We rely on a small set of managed infrastructure and service providers to run
Cognee Cloud.

***

## 6. Data protection & GDPR

Cognee is operated by **Topoteretes UG**, Schönhauser Allee 163, 10435 Berlin,
Germany — so your data is handled under **EU / German data-protection law**.

* **Data Controller:** Topoteretes UG (Berlin, Germany).
* **Data Protection Officer:** heyData GmbH, Berlin.
* **Your GDPR rights** — access, rectification, erasure, restriction,
  portability, and objection — are supported in line with the GDPR.
* **Deletion & erasure:** because each tenant's data lives in a dedicated
  database, deleting a tenant deletes the entire database — there is no residue
  in shared tables. Backup copies age out per the retention window.

***

## 7. Certifications — where we stand honestly

We do **not** currently hold SOC 2, ISO 27001, or an equivalent third-party
audit certification. We believe it is more useful to tell you exactly what we do
than to imply an attestation we don't have.

The controls described above — physical tenant isolation, encryption in transit
and at rest, least-privilege credentials, secrets management, and backed-up
durable storage — map directly to the technical safeguards those frameworks
require. If your organization needs a formal certification or a signed Data
Processing Agreement (DPA) before adopting Cognee Cloud, please reach out — we're
happy to discuss your requirements and share more detail under NDA.

***

*Last reviewed: 2026-07-22. This document describes the current architecture and
will be updated as our controls evolve.*