Security & compliance
Designed for audit.
Governance is the product. This page is written to be forwarded to a compliance or risk team — it describes exactly what we receive, how long we hold it, and how every decision is made auditable.
Data minimization
We receive only an application reference plus two name strings. No Aadhaar or PAN numbers, no dates of birth, no addresses, no document images, no biometrics, no financial data.
Complete audit trail
Every decision logs the confidence score, reasoning, timestamp, model version, and — for human decisions — the operator identity. Queryable for five years.
Never auto-rejects
Uncertain cases are routed to human review, never rejected by the model. A dead-letter queue captures failed messages so nothing is silently dropped.
Tenant isolation
Each partner is a distinct tenant. Cross-tenant reads are denied at the API layer, and dashboard access is authenticated with role-based access control.
Regulatory mapping
Designed with reference to the DPDP Act, the RBI KYC Master Direction and PMLA retention rules. SOC 2 is planned.
Data residency
Hosted on AWS Asia Pacific (Sydney) today. India-region (Mumbai) hosting is planned before any client processes production data. We will confirm current residency in writing during pilot onboarding.
The 7-day PII lifecycle
Personally identifiable data has a strict, short lifespan. The decision record that satisfies auditors lives on; the names do not.
Ingress
Data enters over encrypted HTTPS.
Buffer
Requests hold briefly in a durable queue (max ~1 day) to prevent loss during spikes.
Process
LLM reasoning runs in-memory; raw names are not persisted for reasoning.
Store
The decision record is written to an encrypted, managed database.
Scrub
After 7 days, name strings are replaced with "[SCRUBBED]".
Retain
The non-PII decision record is kept for 5 years for PMLA compliance.
Regulatory status
Cognance is a technology service provider to regulated financial institutions. It is not a lender and is not registered with or regulated by the Reserve Bank of India. Every output is a recommendation; the client institution retains every decision and its regulatory obligations.
Subprocessors
The third parties we rely on to run the website and the KYC service, and what each one handles.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, processing, AI model inference (Amazon Bedrock) | Client KYC data (name strings, decision records) | Asia Pacific (Sydney) |
| Cloudflare | Website hosting and delivery | Website visitor technical data | Global edge network |
| Formspree | Pilot-form handling | Enquiry details | United States |
| Google Workspace | Correspondence | Per Google’s infrastructure |
We will notify clients before adding a subprocessor that processes their data.
Report a vulnerability
If you believe you've found a security issue, email security@cognance.in. Please don't access or modify data that isn't yours, and give us reasonable time to fix the issue before disclosing it.
If a security incident affects a client's data, we notify that client without undue delay, within 72 hours of becoming aware.
Have a compliance question we haven't answered?
We're happy to walk a risk or compliance team through the approach in detail.