Security posture.

1. Security overview

CogniLead is a multi-tenant SaaS that runs email outbound on each customer's supplied leads and generates AI content scaffolding. Tenant isolation is enforced at the database layer rather than the application layer, so a tenant can never read another tenant's leads, campaigns, or generated content. The security posture described below is the floor, not the ceiling, and is reviewed at least once per quarter.

2. Authentication

• Identity provider: Supabase Auth.
• Multi-factor authentication is enforced on first dashboard use and may not be disabled.
• SAML single sign-on is available on the Enterprise tier, with customer-controlled IdP.
• Sessions expire after a maximum of 30 days and are invalidated on password change or MFA reset.

3. Tenant isolation

• Postgres Row Level Security policies on every table keyed by tenant_id.
• The application-tier never issues a query without a tenant identifier in the session context; the database is the final authority for visibility.
• Cross-tenant isolation is verified by an independent third-party penetration test before public GA, and re-tested annually.

4. Secrets management

• Customer-supplied credentials stored on your behalf (e.g. BYO SMTP passwords) are envelope-encrypted at rest with AES-256-GCM under an app-managed key — never persisted in plaintext.
• No tenant-specific secrets live in source code or container images. Platform-level operational secrets (deploy credentials, infra tokens) are held in the host’s managed secret store.

5. API keys

• Scope-limited pk_live_* keys per tenant, with default-denied customer sub-keys for delegated (reseller) access.
• Keys are hashed at rest with Argon2id; the raw value is shown only once at creation, never again.
• After creation only the last four characters are surfaced in the dashboard for identification.
• Keys can be revoked at any time; revocation takes effect immediately on the next request.

6. Network

• TLS 1.3 only; older protocols are refused at the edge.
• HSTS with a 2-year max-age and preload list inclusion. Certificate pinning is offered to Enterprise.
• Strict Content Security Policy. Inline script execution is blocked except for narrowly scoped, hash-pinned bootstraps.
• frame-ancestors 'none' on every response; the dashboard cannot be framed by third parties.
• Permissions-Policy locked down: camera, microphone, geolocation, payment, USB, and similar features are denied platform-wide.

7. Operational logging

• Sensitive dashboard actions and API calls are logged with tenant_id, actor, action, resource, ip for security and abuse investigation.
• Outbound delivery events (sends, bounces, replies, unsubscribes) are recorded per tenant so suppression and one-click (RFC 8058) unsubscribe state stays accurate.
• Logs are access-controlled and retained for a bounded window; they are an internal security and operations control, not a product feature or customer-facing evidence record.

8. Data residency

• Primary tenant data (accounts, leads, campaigns, generated content) is hosted in the EU (Supabase, eu-west-1).
• LLM inference for SEO generation and outbound personalisation is performed by phi-cloud, our LLM provider. CogniLead does not use phi-cloud's HIPAA / PHI / patient-data tier and sends no patient data to it.
• Re-region of an existing tenant is a controlled operation that requires a service ticket; in-flight sends are paused during the migration window.

9. Encryption

• TLS 1.3 for all data in transit.
• AES-256 for all data at rest (Supabase default).
• Customer-managed KMS is available on the Enterprise tier, with the customer's root key held in their own KMS instance.
• Backup snapshots are encrypted with a separate key from the primary store.

10. Compliance roadmap

11. Backups

• Encrypted snapshots taken daily.
• 30-day retention.
• Stored in a geographically separate zone within the same EU hosting region as the primary store.
• Restore drills are run at least quarterly.

12. Incident response

• 4-hour pager rotation, 24/7.
• Public status page at status.cognilead.ai with component-level granularity.
• Customer notification of a confirmed Personal Data breach within 48 hours of discovery, via email to the address on the account and a banner in the dashboard.
• Public post-mortem within 7 days of resolution for any incident of customer-visible scope.

13. Vulnerability disclosure

Report security issues to security@cognilead.ai. PGP key fingerprint (placeholder, replace with published key before GA):

-----BEGIN PGP PUBLIC KEY BLOCK-----
Fingerprint: XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX
(Replace with the production key before GA. Until then, encrypted reports
 may be sent using the maintainer's published personal key on keys.openpgp.org.)
-----END PGP PUBLIC KEY BLOCK-----

• We follow a 90-day coordinated disclosure timeline. We will negotiate an extension only when a fix demonstrably requires it.
• We do not pursue legal action against good-faith security researchers who comply with this policy.
• Responsible reporters who request public credit are listed in our security acknowledgments after the issue is resolved.