> For the complete documentation index, see [llms.txt](https://docs.kosmoslabs.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kosmoslabs.ai/product-documentation/security-overview.md).

# Security Overview

**V1.4 · Updated August 2026**

{% hint style="success" %}
**Read-only by design.** Kosmos requests minimum required scopes across all connected systems. We read signal metadata to surface root cause; we never write to your source systems, and we never duplicate raw data beyond what correlation requires.
{% endhint %}

***

## At a Glance

* **0** high-severity findings — OWASP ZAP DAST across 247 endpoints (Mar 2026)
* **TLS 1.3** encryption in transit
* **OAuth 2.0** read-only integrations across all connectors
* **SOC 2 Type 1** report issued — see our [Trust Center](https://trust.kosmoslabs.ai)

***

## Infrastructure & Application Security

### GCP-Native Architecture

Kosmos is deployed entirely on Google Cloud Platform. No third-party infrastructure providers are used for compute, storage, or networking.

**Services in use:**

* **Cloud Run** — stateless API and service execution
* **Cloud SQL (PostgreSQL)** — structured signal and correlation data
* **Google Cloud Storage** — signal metadata and artifact storage
* **DuckDB** — embedded analytical query engine for correlation workloads
* **Vertex AI (Gemini 2.5 Flash)** — RCA generation and `text-embedding-004` embeddings

### Encryption

* **In transit:** TLS 1.3 across all endpoints and service-to-service calls
* **Application layer:** OAuth tokens encrypted before storage
* **Secrets:** Managed in GCP Secret Manager with version control and access audit logs

### Authentication

* **User sessions:** Firebase Auth; tokens validated on every API call
* **Service-to-service:** GCP IAM service accounts; no long-lived credentials shared across services

### Multi-Tenant Isolation

Data is isolated at the application layer. Every record, query, and storage operation is scoped by organization identifier. Tenant boundaries are enforced regardless of storage backend.

### Network Protection, CSRF & Rate Limiting

* **Cloud Armor** — public API traffic is protected at the network edge against volumetric and application-layer denial-of-service attacks
* State token validation on all OAuth authorization flows
* Double-submit cookie pattern on all state-changing requests
* IP-based rate limits on all public-facing endpoints
* Per-key rate limits on public API requests, with standard rate limit headers on every response

### Audit Trail & PII Redaction

Auth events, integration activity, and RCA generation are written to a structured audit trail. Email addresses and credentials are redacted before log emission.

***

## Data Handling

### What Kosmos Reads

Signal metadata from connected systems: issues, tickets, commits, messages, and traces. All integrations operate on minimum required, read-only scopes.

### What Kosmos Stores

Signal metadata and correlation results only. Kosmos does not duplicate raw source records beyond what correlation requires. Data is stored in Cloud SQL (PostgreSQL), Google Cloud Storage, and DuckDB.

### Data Deletion

On contract termination, all customer data is deleted within **30 days**. Hard-delete is available on written request to <security@kosmoslabs.ai>.

### Subprocessors

* **Google Cloud Platform** — compute, storage, networking
* **Vertex AI (Gemini 2.5 Flash)** — RCA generation and `text-embedding-004` embeddings
* **Firebase Auth** — user authentication

A complete subprocessor list including notification providers is available on request.

***

## Connected Systems

### Generally Available

Jira · Salesforce · ServiceNow · Zendesk · GitHub · Bitbucket · GitLab · Azure DevOps · Slack · Microsoft Teams · Linear · Pylon

### Preview

{% hint style="info" %}
**OpenTelemetry** is currently in preview. Supported observability platforms: Datadog, Grafana, Splunk, Dynatrace, AWS CloudWatch, Azure Monitor, Google Cloud Observability, and New Relic. Contact your account team to enable OTel for your organization.
{% endhint %}

***

## SOC 2 Certification Path

### ✅ Complete — Mar 2026 · Codebase Security Review

OWASP ZAP DAST scan across 247 endpoints. **0 high-severity findings.**

### ✅ Complete — Apr 2026 · Salesforce AppExchange Security Review

Kosmos passed the Salesforce AppExchange security review. The managed package is available for installation in production and sandbox Salesforce orgs. [View on AppExchange](https://appexchange.salesforce.com/appxListingDetail?listingId=a0NHu00000srMgrMAE).

### ✅ Complete — May 2026 · P0 Audit Blockers

Vendor risk register, data processing agreements (DPAs), and incident response plan finalized.

### ✅ Complete — Jul 2026 · SOC 2 Type 1 Audit

Point-in-time controls assessment complete. The SOC 2 Type 1 report is available through our [Trust Center](https://trust.kosmoslabs.ai) on request.

### 🟣 Targeted — Q3/Q4 2026 · SOC 2 Type 2 Audit

Accelerated observation period based on scope. Type 2 report targeted Q3/Q4 2026.

***

## Security Contact

Security inquiries are answered within **1 business day**.

**Email:** <security@kosmoslabs.ai>

Available on request:

* SOC 2 Type 1 report
* Penetration test results
* Data Processing Agreement (DPA)
* Security questionnaire responses
* Complete subprocessor list

Our [Trust Center](https://trust.kosmoslabs.ai) collects our security policies, monitored controls, and compliance documentation in one place for procurement and security reviews.

***

**Questions?** Contact <support@kosmoslabs.ai> | [app.kosmoslabs.ai](https://app.kosmoslabs.ai/)

© 2026 Kosmos AI Labs, Inc.