Security, Privacy & Legal
Everything you need to verify C2 meets your data protection requirements before you sign. Transparent by design.
Legal Documents
Download & Review Our Legal Agreements
All documents are available for download and review before you commit. No request required.
Data Processing Agreement
Our Art. 28 GDPR-compliant DPA: how C2 processes personal data on your behalf, covering ROPA, DSARs, breach notification, sub-processors, and data deletion. Accepted automatically on signing your subscription.
Terms and Conditions
The master subscription agreement governing your use of C2: licence grant, fees, warranties, limitation of liability, and governing law (Netherlands).
Privacy Policy
How Agile Futurist collects and processes personal data as a controller for website visitors, prospects, and contacts (separate from customer tenant data).
Sub-processor Register
Third Parties We Use to Deliver the Platform
In line with Art. 28(3)(d) GDPR, we maintain a public register of all sub-processors. You will receive at least 30 days advance notice of any additions or changes.
| Sub-processor Category | Purpose | Processing Location | Transfer Mechanism | DPA Status |
|---|---|---|---|---|
| Cloud Infrastructure & Hosting | Primary compute, storage, networking and databases underpinning the platform. | European Union | N/A (EEA) | Signed, Art. 28 |
| Email Delivery Service | Transactional and notification emails: DSAR alerts, onboarding flows, system notifications. | EU / EEA | N/A or SCC Module 3 | Signed, Art. 28 |
| AI Model Provider | Processing of AI HR Assistant queries. No training on customer data. | EU preferred | N/A (EEA) or SCC Module 2 | Signed, Art. 28 + AI Act |
| Platform Monitoring & Observability | Application performance monitoring and error tracking. Pseudonymised data only. | European Union | N/A (EEA) | Signed, Art. 28 |
| Customer Support Platform | Management of support tickets from your users. Restricted to support personnel only. | EU / EEA | N/A or SCC Module 3 | Signed, Art. 28 |
Last updated: April 2026. To receive sub-processor change notifications by email, contact dpo@cognitis.cloud with subject “Sub-processor notifications”.
Security Measures
Technical & Organisational Measures (TOMs)
A summary of our security measures as defined in Schedule 2 of the DPA. The full Schedule is available in the downloadable DPA above.
Access Control
- Role-based access (RBAC), least privilege
- MFA enforced for admin accounts
- Session timeout, unique credentials
- Privileged access management
Encryption
- In transit: TLS 1.2+ (TLS 1.3 preferred)
- At rest: AES-256
- Database-level encryption
- Annual key rotation
Tenant Isolation
- Strict logical separation between tenants
- Tenant identity enforcement at ORM layer
- Automated isolation tests on every deployment
Infrastructure
- EU-only hosting (ISO 27001 data centres)
- Network segmentation, IDS/IPS, WAF
- DDoS mitigation in place
Vulnerability Management
- Annual third-party penetration testing
- Automated dependency scanning (CI/CD)
- Critical patches within 72 hours
Availability & Recovery
- 99.5% uptime SLA
- Daily backups, 30-day retention
- Quarterly DR testing
Incident Response
- 72-hour breach notification to controller
- Documented incident response plan
- Real-time SIEM alerting
- Art. 33(5) breach register maintained
Privacy by Design
- Data minimisation in all features
- DPIA required before high-risk deployments
- Automated retention enforcement
Compliance & Certifications
Our Certification Roadmap
We are transparent about where we are on the path to independent verification. Track our progress here.
Full DPA published, sub-processor register maintained, DPO designated. All processing on documented controller instructions only.
All customer data stored and processed exclusively in EU-based infrastructure. No cross-border transfers without explicit safeguards and customer consent.
Internal review of NIS 2 obligations applicable to C2 as a digital service provider. Policy updates underway.
Independent third-party penetration test commencing in 2026. Executive summary available to Enterprise tier customers under NDA on request.
ISO 27001 gap assessment commencing in 2026. Target certification within 18 months. The recognised standard for information security management, mapping directly to GDPR Art. 32.
The privacy management extension to ISO 27001, directly mapping to GDPR obligations. Targeted following ISO 27001 certification. C2 will be among the first SME HRIS platforms in Europe to hold this certification.
Tracking accredited Art. 42 GDPR certification schemes in the Netherlands and EU (including EuroPriSe). Will pursue once a mature scheme for SaaS processors is established.
Document History
Legal Document Change Log
Material changes are communicated to existing customers at least 30 days before they take effect.
To receive legal update notifications, email dpo@cognitis.cloud with subject “Legal update notifications”.
Data Protection
Contact Our Data Protection Team
For questions about data protection, GDPR compliance, the DPA, or to exercise data subject rights.
Data Protection Officer
Security & Incidents
Legal & Contractual
Ready to see the most GDPR-compliant HRIS platform built for European SMEs?
Book Your Free 30-Min Demo →
