Trust and security at Cosmo
Cosmo is SOC 2 Type II compliant and certified to ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 20000-1. The platform runs on AWS with isolated production, sandbox and development environments, encrypts all data at rest and adds field-level encryption for personal data.
Last reviewed: 5 October 2026
Independently audited and certified
The SOC 2 Type II audit and the ISO certification audits were performed by Paralok. Reports and certificates are available to clients on request.
Where and how the platform runs
Hosted on AWS
The Cosmo platform runs on Amazon Web Services, with Frankfurt (eu-central-1) as the primary region.
Isolated environments
Production, sandbox and development run in separate, isolated networks, with separate credentials for each environment.
Resilient data storage
The production database runs across multiple availability zones, with point-in-time recovery for the last 30 days.
Perimeter protection
A web application firewall and continuous threat detection protect production traffic.
How data is protected
Encryption at rest
All databases are encrypted at rest. Personal data is additionally encrypted at field level with AES-256.
Encryption in transit
All traffic to cosmopoints.com and the Cosmo API uses TLS 1.3, and HTTP Strict Transport Security is enforced, so browsers and clients never fall back to an unencrypted request.
Access control
Multi-factor authentication is required for all administrative access, and audit logs are retained for 12 months.
Privacy by law
Personal data is handled under the DIFC Data Protection Law No. 5 of 2020. See the Privacy Policy for details.
Secure by default for developers
OAuth 2.0
API access uses the OAuth 2.0 client credentials flow, with a separate secret for sandbox and production.
Safe retries
Every transaction carries a reference number, so a retried request is never processed twice.
Authenticated webhooks
Webhooks to clients and partners support Basic, OAuth or signature-based authentication.
Subprocessors, status and documentation
Subprocessors
Amazon Web Services hosts the platform (Frankfurt, with a secondary US East region). Google reCAPTCHA protects the website contact form. No other third party processes personal data on Cosmo's behalf.
Status page
Live availability of the API and network services is published on the status page, so a client can confirm the current state before and during an integration.
Penetration testing
An independent penetration test of the platform is carried out every six months, and findings are remediated before the next cycle.
Documents on request
The SOC 2 Type II report, ISO certificates, the latest penetration-test summary, a Data Processing Agreement and completed security questionnaires are available to prospective and current clients on request.
Security questions, answered.
Is Cosmo SOC 2 compliant?
Yes. Cosmo is SOC 2 Type II compliant, covering security, availability and confidentiality controls. The audit was performed by Paralok, and the report is available to clients on request.
Who audited Cosmo's SOC 2 and ISO certifications?
Paralok performed the SOC 2 Type II audit and the ISO/IEC 27001, 27017, 27018 and 20000-1 certification audits.
Does Cosmo run penetration tests?
Yes. An independent penetration test is carried out every six months. A summary of the latest test is available to clients on request.
Does Cosmo offer a Data Processing Agreement?
Yes. A Data Processing Agreement is available on request. Email security@cosmopoints.com.
Which ISO certifications does Cosmo hold?
Cosmo is certified to ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 20000-1, covering information security management, cloud security controls, protection of personal data in the cloud and IT service management.
Is data encrypted in transit?
Yes. All traffic to cosmopoints.com and the Cosmo API uses TLS 1.3 with HTTP Strict Transport Security enforced. Data is also encrypted at rest, and personal data is additionally encrypted at field level with AES-256.
Where can I check Cosmo's service status?
On the Cosmo status page at cosmopoints.com/system-status, which shows the live state of the API and network services.
Where is Cosmo hosted?
The Cosmo platform runs on Amazon Web Services, with Frankfurt (eu-central-1) as the primary region. Production, sandbox and development environments are isolated from each other.
How does Cosmo protect personal data?
All databases are encrypted at rest, and personal data is additionally encrypted at field level with AES-256. Personal data is handled under the DIFC Data Protection Law, and administrative access requires multi-factor authentication.
How do I request Cosmo's SOC 2 report or ISO certificates?
Email security@cosmopoints.com with your company name and the documents you need, and the Cosmo team will follow up.