Security, Privacy & Legal
Everything you need to verify C2 meets your data protection requirements before you sign. Transparent by design.
Legal Documents
Download & Review Our Legal Agreements
All documents are available for download and review before you commit. No request required.
Data Processing Agreement
Our Art. 28 GDPR-compliant DPA: how C2 processes personal data on your behalf, covering our record of processing as a processor, DSARs, breach notification, sub-processors, encryption key management and data deletion. Accepted automatically on signing your subscription.
Privacy Policy
The Privacy Policy and the Cookie Policy cover the cognitis.cloud public website.
Sub-processor Register
Third Parties We Use to Deliver the Platform
In line with Art. 28(3)(d) GDPR, we maintain a public register of all sub-processors. At least 30 days’ advance notice of changes to our own sub-processors. Changes our sub-processors make to theirs are passed on as soon as we are notified.
| Sub-processor | Purpose | Processing Location | Transfer Mechanism | DPA Status |
|---|---|---|---|---|
| Amazon Web Services (AWS) Cloud Infrastructure & Storage (S3) |
Primary compute, object storage (Amazon S3), networking and databases underpinning the platform. | EU (Ireland, eu-west-1) | N/A (EEA) | Signed, Art. 28 |
| Amazon Web Services (SES) Email Delivery |
Transactional and notification emails: DSAR alerts, onboarding flows, system notifications. | EU (Ireland, eu-west-1) | N/A (EEA) | Signed, Art. 28 |
| Mistral AI SAS AI Language Model (default) |
Default language model provider for the AI assistant on the Frontoffice and the Learning Portal. Receives the questions people type into the assistant and the knowledge-base excerpts it answers from. The assistant has no access to HR records, and users are asked not to type personal or health details. Knowledge retrieval uses a self-hosted Qdrant vector database on EU (Ireland) infrastructure. The Platform sends every request to Mistral’s EU endpoint. Mistral does not use Controller data to train its models and keeps no copy of requests (Zero Data Retention). On request, SME and Enterprise customers can have the Frontoffice assistant answer from their own AI host instead. | EU (Mistral AI, Paris, France) | N/A (EEA) | Signed, Art. 28 |
| Amazon Web Services (CloudWatch) Platform Monitoring & Observability |
Application performance monitoring, logging and alerting via AWS CloudWatch. Covered by the same AWS DPA as core infrastructure. | EU (Ireland, eu-west-1) | N/A (EEA) | Signed, Art. 28 |
Not a sub-processor: Frappe HelpDesk. Frappe HelpDesk is part of the C2 product, hosted by us.
Who the AI assistant serves. The assistant is available only to people signed in, on the Frontoffice and the Learning Portal. It is never on the Jobs Portal and not part of the Startup plan, and each customer can switch it off. It makes no decisions about people.
Last updated: October 2026. To receive sub-processor change notifications by email, contact dpo@cognitis.cloud with subject “Sub-processor notifications”.
Security Measures
Technical & Organisational Measures (TOMs)
A summary of our security measures as defined in Schedule 2 of the DPA. The full Schedule is available in the downloadable DPA above.
Access Control
- Role-based access (RBAC), least privilege
- Multi-factor authentication required for every employee and administrator at every sign-in, with a one-time code sent by email
- Session timeout, unique credentials
- Privileged access management
Encryption
- In transit: TLS 1.2+ (TLS 1.3 preferred)
- At rest: AES-256 with AWS KMS
- Keys created for your tenancy alone
- Your own key material (tenant custody): on request, any plan
Tenant Isolation
- Your own single-tenant environment
- No shared databases or storage
- Separate encryption keys per tenancy
Infrastructure
- EU-only hosting (ISO 27001 data centres)
- Network segmentation, IDS/IPS, WAF
- DDoS mitigation in place
Vulnerability Management
- Internal security audits against OWASP ASVS Level 2 completed in September and October 2026
- An independent penetration test by a qualified third party is planned
- Automated dependency scanning (CI/CD)
- Security updates to the operating system and components are taken in on every release, and portal software is updated weekly
Availability & Recovery
- 99.5% monthly availability, measured 24 hours a day, 7 days a week, excluding announced maintenance windows
- Daily backups, 30-day retention
- Restores are rehearsed every quarter for every component, against recovery targets of at most one hour and a recovery point of at most 24 hours
Incident Response
- If a personal-data breach affects your data, we notify you without undue delay, and in any event within 24 hours of becoming aware of it. We share what we know at once and complete the picture as our investigation progresses, so you can meet your own 72-hour deadline with your supervisory authority
- Documented incident response plan
- Security events logged and monitored with CloudWatch alarms; alerts are read and acted on daily, weekends and holidays included, by our DevOps team
- Art. 33(5) breach register maintained
Privacy by Design
- Data minimisation in all features
- DPIA required before high-risk deployments
- Retention periods set per data category; candidate, helpdesk, CRM and internal support data are erased or anonymised automatically when their period ends, and other categories are reported for review
- No tracking: the portals set no cookies that need consent, serve their own fonts, and send nothing to Google Fonts or Gravatar
Data Protection Governance
- An external DPO is designated
- The data protection impact assessment (DPIA) was approved with conditions in September 2026
- The record of processing was accepted in October 2026
Sign-in
- The identity server runs in each customer’s own environment
- Passwords never leave the HR system in readable form
Erasure & Exit
- Erasure was rehearsed in September 2026
- Once a customer has supplied its export key, every backup also has an export copy only the customer can open, so leaving is never blocked by us
Encryption Key Management
Who holds the keys to your data
Every C2 environment is encrypted at rest with AWS KMS, under keys created for your tenancy alone: one for your databases, one for your uploaded content, and two for the platform’s own secrets and logs. You choose who holds the material of the two data keys.
Platform custody Live Default
C2 manages the encryption keys on your behalf in AWS KMS, with annual key rotation. This is the default on all plans and requires nothing from you.
Tenant custody Live On request, any plan
You generate the key material on your own computer, wrap it so that only the key service can open it, and keep your own copy. C2 receives the wrapped material and passes it to AWS KMS. C2 never sees the material itself. The ceremony runs in an ordinary web browser, with nothing to install, and takes about fifteen minutes.
At any point you can withdraw the key service’s copy of your material: yourself, without C2’s cooperation, through a cloud account you have nominated, or otherwise by instructing C2 to withdraw it. Every stored copy of your data becomes unreadable to every party at once, C2 and AWS included. The running service stops within hours, at its next restart at the latest.
You restore access by re-importing the material you kept. On Start-up and SME plans restoration is complete. On Enterprise plans there is one exception: a database instance left inaccessible for more than seven days is lost as an instance and is restored from backup instead.
C2’s tooling refuses to schedule deletion of a tenant-custody key, and no C2 operator identity holds a standing right to decrypt your data. Any call against your keys by an identity that is not your tenancy’s own is recorded in an audit trail and raises an alarm.
Export copies only you can read Live
Every backup and every long-term archive is written twice: once for C2’s disaster recovery, under your tenancy’s keys, and once as an export copy encrypted to a key that only you hold. You can open the export copies on your own computer, with C2 absent, and a withdrawal does not affect them. They are your exit and your independence, in both custody modes. Export copies are written once you have supplied the public half of your export key; under tenant custody the ceremony produces it.
What this does and does not change. Tenant custody narrows who can read your data and gives you a way to withdraw our access. It does not place your data beyond the reach of legal process: our infrastructure runs on AWS, a US-headquartered provider, in EU regions. C2 can decrypt your data during normal operation, because we operate the platform on your behalf; tenant custody means you can end that at will, not that we never had access. For questions about the US CLOUD Act, contact our Data Protection Officer at dpo@cognitis.cloud.
Compliance & Certifications
Our Certification Roadmap
We are transparent about where we are on the path to independent verification. Track our progress here.
GDPR Art. 28 Compliance Live
Full DPA published, sub-processor register maintained, DPO designated. All processing on documented controller instructions only.
EU Data Residency Live
All HR and employee data is stored and processed in the EU (Ireland, AWS eu-west-1). The AI assistant uses a self-hosted Qdrant vector database on EU infrastructure for knowledge retrieval; no personal data is indexed. Personal data is stored and processed in the EU.
NIS 2 Directive Assessed
Assessed: outside NIS 2 scope on size (September 2026), reviewed every year. Where a customer’s own NIS 2 duties require supplier measures, we agree them in the contract.
Security Audits & Penetration Testing Pen test planned
Internal security audits against OWASP ASVS Level 2 were completed in September and October 2026. An independent penetration test by a qualified third party is planned.
ISO 27001 Certification Gap Assessment 2026
ISO 27001 gap assessment commencing in 2026. Target certification within 18 months. The recognised standard for information security management, mapping directly to GDPR Art. 32.
ISO/IEC 27701 Certification In preparation
In preparation. Preparation starts in November 2026; certification is expected in Q2 2027.
GDPR Art. 42 Certification Monitoring
Tracking accredited Art. 42 GDPR certification schemes in the Netherlands and EU (including EuroPriSe). Will pursue once a mature scheme for SaaS processors is established.
Document History
Legal Document Change Log
Material changes are communicated to existing customers at least 30 days before they take effect.
To receive legal update notifications, email dpo@cognitis.cloud with subject “Legal update notifications”.
Data Protection
Contact Our Data Protection Team
For questions about data protection, GDPR compliance, the DPA, or to exercise data subject rights.
Data Protection Officer
Security & Incidents
Legal & Contractual
Ready to see the HRIS built specifically for European SMEs: transparent, GDPR-compliant and verifiable?
Book Your Free 30-Min Demo
