Security and confidentiality
Our clients trust us with sensitive information about their systems, data, and risks. Here’s how we protect it.
The short answer
Every engagement is covered by a confidentiality agreement. Client information is kept only in approved business systems with encryption and multi-factor authentication, accessed only by the people working on the engagement, and returned or deleted when the engagement ends.
How we protect client information
| Control | What we do |
|---|---|
| Confidentiality | A nondisclosure agreement or confidentiality terms cover every engagement. Consultants working with us are bound by written confidentiality obligations. |
| Access | Only the people working on your engagement can access your information, and access ends when their work ends. |
| Authentication | Multi-factor authentication is required on every business account, and passwords are managed in a password manager. |
| Encryption | Client information is encrypted in transit and at rest in our business systems. |
| Approved systems | Client information is stored only in approved business systems, never in personal accounts or consumer AI tools. |
| Data location | Client information is stored in the United States unless a client agrees otherwise. |
| Retention and deletion | When an engagement ends, we return or delete your information within 30 days unless you ask us to keep it or the law requires us to. |
| Incident notice | If a security incident affects your information, we notify you within 24 hours of discovery with the facts you need for your own notices. |
| Privileged work | When your counsel directs an engagement, we follow their instructions on how findings are documented and shared. |
Insurance
Cogent Assurance carries professional liability (errors and omissions), cyber liability, and general liability insurance. We provide certificates of insurance on request during contracting, and where a contract requires it, we can name clients as additional insureds on our general liability policy.
For vendor reviews
If your organization requires a security questionnaire or specific contract terms before engaging us, contact us and we’ll complete it as part of scoping.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.