How your data is kept safe

Last updated September 18, 2026

Cosmentum holds the thing an agency cannot lose: every client, what each one pays, and the notes nobody outside the business should read. That is a lot to ask you to hand over, so this page says exactly what protects it — with specifics, because “we take security seriously” is what gets written when there is nothing to point at.

One workspace cannot see another

Every record in Cosmentum carries the id of the workspace it belongs to, and every screen reaches its data through a single gate that asks who is asking before it returns anything. A new page is protected because it cannot read without going through that gate — not because somebody remembered to protect it.

That boundary is not left to good intentions. Every release runs a test that signs in as a customer seat and tries to open the screens that read across all workspaces. If it ever succeeds, the release stops.

Signing in

• Passwords are hashed with scrypt, with the work factor stored beside each hash so it can be raised later without asking anybody to change their password. We cannot tell you yours, because we do not have it.
• Your session is 32 random bytes in a cookie marked httpOnly, so no script can read it, scoped to this app alone and checked against a record we can end. A user id in a cookie is not identity — it is not secret, and the browser can edit it.
• One live session per seat. Signing in somewhere else ends the first session and tells that person their seat was opened elsewhere. A shared login becomes visible instead of silent.
• Ten wrong passwords locks that seat for fifteen minutes, and a failed attempt answers the same way whether or not the address exists, so the sign-in page cannot be used to find out who works at an agency.
• Invitation and reset links are stored hashed, work exactly once, and expire — a week for an invitation, an hour for a reset. Issuing a new one kills the one before it, so a forwarded old email is already dead. Asking repeatedly slows down rather than locking you out.

When we open your workspace

Only to help you, and never quietly. Support access goes in as a seat named Cosmentum Support, and the rules are enforced by the software rather than by policy:

• a reason is written down before the door opens;
• you can read every visit in your own settings — who, why and how long — and we cannot remove that record;
• anything we touch is recorded under our name, never one of yours;
• nobody is signed out, because we never borrow one of your seats;
• the visit stops working by itself after an hour.

Where it lives

On managed PostgreSQL in New York, closed to the public internet. It accepts connections from the application and from one named address, and nothing else can reach it at all. Everything in transit is encrypted.

Uploads are checked by what the bytes actually are rather than by what the file claims to be, and anything the app fetches on your behalf is blocked from reaching private addresses — the flaw that lets an innocent looking URL read a server’s own internals. Both have tests that try the attack and expect to fail.

If something is lost

There are two independent copies, on purpose.

• Seven days of point-in-time recovery at the hosting provider, which can rewind the database to any second in that window.
• Encrypted backups held somewhere else entirely, so that losing one account cannot lose both the data and its copies. They are encrypted with AES-256-GCM before they leave, and swept after 30 days.

Every backup is read back out of storage, decrypted, and counted against the live database before it is called a backup. An upload that returned success is not evidence that anything usable was stored — that is the assumption behind most backups that turn out to be empty.

And restoring has been rehearsed rather than assumed: 534 clients deleted on a throwaway copy, 1,032 rows across every table back in 13 seconds, with nothing left broken behind them.

What leaves the building, and what does not

When code breaks, the error report is stripped before it is sent: no names, no email addresses, no search terms, no connection strings, no session tokens. What gets sent is the error, the page, and the workspace as a meaningless identifier — enough to answer “is this one agency or all of them” and not enough for anyone to learn who our customers are. Session recording is switched off.

There is one cookie, and it exists to keep you signed in. No advertising pixel, no analytics tag, no third party script following anybody around — which is why Cosmentum has no cookie banner. There is nothing to ask permission for.

If you connect Google Drive, we ask for the narrowest access Google offers: the app can see only the folders and files it created itself, never the rest of your Drive. Your documents stay in your Drive and are never copied onto our servers.

Your data is yours, including on the way out

You can download the entire workspace as spreadsheets at any time, without asking us — clients, contacts, campaigns, projects, pipeline, tasks, the timeline, your custom fields and every change ever made to them, with names written out rather than internal identifiers.

If you leave, the workspace stays readable for 30 days so you can take it with you, and then it is deleted in full. That deletion has been tested the same way everything else here has: a workspace holding 742 rows across 31 tables, removed, nothing left anywhere.

How changes reach you

The failure that takes a product like this down is rarely an attacker. It is a careless release.

• Over 170 automated checks run before anything ships — the pages load, the tenancy boundary holds, the bill adds up, the permission gate refuses, the links expire, the backup decrypts.
• A dress rehearsal on a copy of production. Every schema change is applied to a real copy of the live database, the app is built and booted against it, and the whole suite is run there — before it touches yours.
• Schema changes are reviewed files, never automatic. The convenient tool compares your database to the code and does whatever closes the gap, including dropping a column and everything in it. We do not use it.
• Deploys are verified, not assumed. A release is not called done until the new version answers consistently from every server, because the version being replaced returns success just as happily.
• The site is watched from outside every five minutes, because software that has stopped answering throws no error to report.

What we have not done

A security page with no gaps in it is a page nobody should believe. Here are ours.

• No third-party security audit or SOC 2 report. Everything above is our own work, checked by our own tests. If you need an independent assessment before signing, say so and we will talk about it rather than pretend otherwise.
• No uptime guarantee. We watch it constantly and we have not had an outage, but we are not promising a number we have not yet earned the operating history to stand behind.
• No two-factor authentication yet. It is the next thing being built on this list.
• We do not hold payment details at all, which is less a gap than a decision: no card numbers exist in Cosmentum to lose.

Telling us something

If you find a problem, email [email protected] and a person reads it. We would rather hear it from you than from anybody else, and we will tell you what we did about it.

If there is ever a breach affecting your data, you will hear it from us without delay and in any case within 72 hours of us knowing — what happened, what it touched, and what we are doing.