# How does Cosine support enterprise security and compliance?

**Cosine is built for enterprises that need rigorous security, privacy, and compliance standards.**

It aligns with global frameworks including **SOC 2, ISO 27001, GDPR, and CCPA**, and supports deployments in the **cloud, VPC, or fully on-premise environments** to meet internal governance and regulatory requirements.

***

#### **Enterprise-grade compliance**

Cosine follows the same security and operational controls required by enterprise procurement and risk teams:

* **SOC 2 Type II and ISO 27001 alignment**, with documentation available for review.
* **Data residency and regional hosting options** to meet jurisdictional requirements.
* **Detailed audit logging and traceability** of all agent actions.
* **Role-based access control (RBAC)**, SSO/SAML support, and optional SCIM provisioning.
* **Encryption in transit and at rest**, using industry-standard key management.

These measures ensure Cosine can be safely deployed in regulated sectors such as finance, defence, and healthcare.

***

#### **Private and controlled deployments**

Enterprises can choose where and how Cosine operates:

* **VPC:** Deployed inside your own AWS, Azure, or GCP environment, with zero data egress and full administrative control.
* **On-premise:** Fully air-gapped deployments with no external dependencies, ideal for high-security or regulated industries.
* **Cloud:** Managed by Cosine, designed for fast onboarding and trials, with the same encryption and access controls as enterprise environments.

All deployment options include the same governance, logging, and audit capabilities.

***

#### **Auditability and assurance**

Cosine provides complete transparency into how agents operate:

* Every task, file access, and model call is recorded in an **immutable audit log**.
* Administrators can view or export logs to SIEM tools for internal audits.
* Post-incident reports and compliance documentation are available on request for enterprise customers.

***

#### **Support for regulated environments**

Cosine’s compliance posture is maintained through:

* **Annual third-party penetration testing** and continuous vulnerability scanning.
* **Security and privacy reviews** aligned to customer vendor assessment frameworks (SIG, CAIQ, DPA).
* **SLAs and uptime commitments** for production environments.

Together, these measures give enterprises the confidence to integrate Cosine within their most sensitive workflows.

***

#### **Related pages**

* [How does Cosine handle security, privacy, and IP?](https://www.notion.so/How-does-Cosine-support-enterprise-security-and-compliance-29daa81af4ab8097ab20d7153c02617e?pvs=21)
* [Is Cosine SOC 2 / ISO 27001 compliant?](https://www.notion.so/How-does-Cosine-support-enterprise-security-and-compliance-29daa81af4ab8097ab20d7153c02617e?pvs=21)
* [Procurement and compliance documentation](https://www.notion.so/How-does-Cosine-support-enterprise-security-and-compliance-29daa81af4ab8097ab20d7153c02617e?pvs=21)
* [SLAs, support tiers, and incident response](https://www.notion.so/How-does-Cosine-support-enterprise-security-and-compliance-29daa81af4ab8097ab20d7153c02617e?pvs=21)

→ Next: [Where does Cosine run?](https://docs.cosine.sh/~/revisions/kY5IYF225VKGNJKxi3Yo/faqs/security-and-compliance/where-does-cosine-run)