Azure, US regions only
Cohesio runs on Microsoft Azure in US regions, with no cross-region replication of client or engagement data outside that boundary.
What’s actually true about security, in plain language
We’d rather tell you exactly what’s in place and what’s in progress than make a claim we can’t back up. This page is kept current as controls change.
What happens between an upload and a closed month
Every file moves through the same seven steps, in order, before it’s ever counted toward a closed engagement.
- UploadA client or staff member uploads through an engagement-scoped link. The connection runs over TLS 1.2 or higher for the entire transfer.
- QuarantineThe file lands in an isolated store before anything reads its contents, so an unchecked upload can’t reach a reviewer’s screen by default.
- ScanA malware scan runs against the quarantined file. Anything flagged is rejected outright and never promoted to the review queue.
- ConvertCleared files are converted to a normalized, reviewable format, so a reviewer opens a consistent rendering rather than a raw file of unknown origin.
- ReviewAI proposes candidate facts with a source, page and version. A named staff member accepts, requests a correction, or waives — never the system itself.
- CloseOnce every requirement is accepted or waived, the engagement closes and a signed decision manifest records who decided what, and when.
- RetentionClosed engagements, their files and their manifests are retained per policy and backed up daily, until the firm removes them or an account closure runs its course.
Every step above runs over an encrypted connection: TLS 1.2 or higher in transit, and AES-256 for files, submissions and decision records at rest.
Five roles, scoped by what each one needs to do
Internal roles are additive — a Reviewer can do everything a Preparer can, plus review. A client’s link can only ever do less.
- OwnerFull account control, including billing, integrations, and the ability to permanently delete an engagement or the account itself.
- AdminManages clients, templates and staff access, and can see every engagement across the firm.
- ReviewerWorks the review queue — accepts evidence, requests a correction, or waives a requirement with a reason.
- PreparerDrafts and issues engagements from a template; requirements typically still route through a reviewer before an engagement closes.
- Client linkThe external, no-login role. Scoped to exactly one current engagement — never another engagement, and never another client’s information.
AI reads and flags. People decide.
Every extraction carries a source file, page reference and version, so a reviewer is checking cited evidence, not trusting an opaque score.
- Can: propose an account number, statement period or closing balance pinned to the exact page it was read from
- Can: flag when this month’s figure looks inconsistent with a prior accepted one, for a person to check
- Cannot: close out a checklist item, dismiss a client’s answer, redirect where a link goes, or notify anyone on its own — every one of those stays a person’s call
- When a page can’t be read or a figure isn’t found at all, the field is left blank rather than filled with a best guess — and any text inside a document is treated as content to read, never as an instruction to follow
Where it runs, and what gets recorded
Immutable audit trail
Every accept, correction request, waiver and completion is written to an audit log capturing who acted, when, and the reason given.
Audit export
Every plan can export an engagement’s activity log as CSV for its own records; Scale adds an advanced audit export format for firms feeding it into other systems.
Sensitive categories excluded
Bank passwords, card security codes, other credentials, medical records, KYC data and payroll administration are excluded from what Cohesio asks for or stores.
What we commit to, in writing
24-hour acknowledgment
If we confirm a security incident affecting your data, we aim to acknowledge it within 24 hours and notify affected firms without undue delay, following a documented response runbook.
Daily backups, 35-day retention
Backups run daily and are retained for 35 days, giving a real recovery point behind a bad import or an accidental deletion.
Vulnerability disclosure
Found an issue? Email security@cohesio.ai directly — a formal bug-bounty submission isn’t required for us to take a genuine report seriously.
Export & deletion on cancellation
Cancelling stops new external intake, AI processing and client messages immediately. An owner or admin then has 30 days to export everything before remaining data is deleted within 30 days after.
Who we work with to run Cohesio
A short, current list of subprocessors that touch application data or delivery.
- Microsoft AzureApplication hosting and storage, US regions
- ResendTransactional and reminder email delivery
- PostHogPrivacy-conscious product analytics
Where we are, honestly
SOC 2 Type II audit underway
Our SOC 2 Type II audit is in progress. We don’t claim certification until it’s complete, and we’ll publish the report here when it is.
Quarantine & malware scan on every upload
This runs today, on every plan, before a single file reaches a reviewer — see the lifecycle above.
Client & engagement isolation
A client’s external access is scoped to their own current engagement — never another client’s records, and never a firm-wide login.
Security questions we’re asked most
Every connection into Cohesio runs over TLS 1.2 or higher. At rest, files, submissions and decision records are encrypted with AES-256. Key management and rotation are handled by our infrastructure provider on its standard schedule rather than a bespoke system we’d have to maintain ourselves.
Whoever your firm assigns to review that engagement, plus any Admin or Owner on the account — visibility follows the role and the assignment, not a blanket firm-wide view by default. A client’s own access never extends past their current engagement, regardless of staff role.
A documented runbook governs detection, containment and notification. We aim to acknowledge a confirmed incident within 24 hours internally, and affected firms are notified without undue delay once impact is confirmed — not held for a quarterly update.
Backups run daily and are retained for 35 days, giving a real recovery point if a bad import or an accidental deletion needs to be undone, rather than relying on the primary copy alone.
Email security@cohesio.ai directly with what you found and how to reproduce it. You don’t need a formal bug-bounty submission for us to take a genuine report seriously, and we aim to acknowledge it within 24 hours.
Questions about our security posture?
Ask us directly — our team can walk through architecture, subprocessors or your firm’s specific compliance questions.