What cogz actually does with your calls

01 — Tenant separation

One workspace cannot read another's, and a test proves it on every commit.

Separation is enforced in the application layer: every query is scoped to a workspace, and session-scoped routes pass through a single gate that resolves the workspace and the caller's access to that account before the route runs.

What makes that claim checkable is a positive-control test that runs against a real PostgreSQL database in continuous integration. It plants a unique marker string in a second workspace's data — the account name, the session's customer name and objective, an answer, an estate fact — then signs in as the most privileged role in the first workspace and walks every route the application exposes, substituting the second workspace's real record identifiers into each one. No response body served to the first workspace may contain the marker. The same sweep is repeated with no sign-in at all.

The test refuses to pass vacuously. It asserts floors on its own coverage before it asserts the result: at least 100 routes walked, at least 60 of them carrying an identifier, at least 10 non-404 responses as the legitimate owner (proving the routes really answer), and — the important one — at least 3 places where the marker is found when the legitimate owner reads their own data. Without that last floor, a broken planting step would produce a green run that proved nothing. It also refuses to run at all without a real database, because the gates under test are permissive when there is nothing to query.

Its limits, since a control's blind spots belong next to the control: the sweep passes identifiers in the URL, so routes that take an identifier in the request body are not covered by it, and neither are query parameters or the callback endpoint the meeting bot vendor posts transcripts to. Those are reviewed by reading the code, which is a weaker guarantee, and this page says which is which.

02 — Meeting audio

On the in-person path, your microphone audio never reaches a cogz server.

When a seller uses the browser microphone, cogz mints a single-use, 60-second token and hands it to the browser. The browser then opens a WebSocket directly to the speech-to-text provider and streams audio there. cogz never proxies the audio and never stores an audio file from this path; the arrangement exists so the transcription provider's API key never reaches the browser and the audio never reaches cogz.

The remote-meeting path is different, and materially so. When a seller sends the meeting bot into a Zoom, Teams or Meet call, that bot is operated by a third party (Recall.ai). It joins the meeting and processes the call's audio and video on its own infrastructure. cogz receives finalized transcript turns and typed in-meeting chat back from it. cogz asks the vendor to delete the bot's media when the meeting ends, but that request is best-effort and is not guaranteed to have run.

What cogz does store, on both paths, is the transcript text. Finalized turns are written to cogz's database so the transcript survives a restart and can be re-analysed after the meeting. "The audio never touches us" is true. "We do not keep what was said" would not be, so this page does not say it.

03 — The record of what the room was told

Consent to record is written down as a durable row. What that row does not yet hold is the sentence the seller actually said.

Before the first capture in a session, the seller confirms the room has been informed. That writes a row recording which capture mode was consented to — browser microphone, or the bot that joins a remote call — together with who attested, when, and by what method. The record is per capture mode: disclosing an in-person recording does not carry over into sending a bot into a later remote call, because the two have different exposure and are consented to separately.

The words are the part that is not real yet, and this page will not describe them as though they were. The row has a column for the disclosure verbatim and a SHA-256 fingerprint of it, and the design reasoning is sound — storing the words and their fingerprint means a later reword cannot be quietly backdated onto old consents, and it answers the only question anyone asks afterwards: consented to what. But the deployed application never sends those words. It posts the capture mode alone, and the server fills the column with a default sentence the seller was never shown on screen and has no way to vary. So read the stored text as the standard script rather than as a record of what was said in that room. A verbatim field filled in by a default is not evidence, and describing it as evidence would be worse than leaving it empty.

Withdrawal marks, it does not delete. If someone in the room asks cogz to be switched off, the consent is marked withdrawn with a timestamp and the withdrawing user. Erasing the row would destroy the only evidence of what was agreed and when it stopped.

Honest scope: this is the record. A hard server-side refusal to capture without it is built and is currently switched off — checked on the production host, not assumed — so that arming it is a deliberate act rather than a side effect of a deploy.

04 — Access logging

Reads of a customer's session are recorded — who, what, when.

Every successful read of a discovery session records the actor, the workspace, the session, the route and the time. Every read of the internal cross-tenant operator console records the same. Both are captured at a single gate rather than sprinkled across individual endpoints, so a new route inherits the logging instead of forgetting it.

Two properties are deliberate. Only permitted reads are logged — a refused cross-tenant request leaves no row, so this is an access record and cogz does not describe it as an intrusion-detection trail it cannot support. And the content read is never written to the log: the record stores the route's template, never the resolved URL, so nothing a caller typed can ride into it. An audit log for a call-recording product that copied the transcript would be a second, less-guarded copy of the most sensitive data in the system.

Because the live assistant polls, repeated reads of the same surface of the same session by the same person inside a five-minute window are recorded as one access episode rather than one row per poll. A different surface, a different session or a different person always opens a new record, and each row states that window on its face so the record explains its own granularity.

Its boundary: this covers reads of a discovery session and reads of the operator console — enumerated, not asserted, by a test that fails if any such route is ever added without the gate. Reads of workspace and account records outside a session are not yet covered, and this page will say so until they are.

05 — Data in transit

Everything between you and cogz is TLS.

Public traffic terminates at Cloudflare. cogz's own containers are reachable only from the host's loopback interface — no service port is published to the internet, and the database publishes no port at all. Every outbound call to a sub-processor is HTTPS or secure WebSocket; email is submitted over STARTTLS.

To be exact rather than flattering: traffic between cogz's own containers on the private Docker network is not itself encrypted. It is isolated, not encrypted, and this page will not call it the latter.

06 — Credentials

Passwords are hashed with bcrypt and a per-password salt; cogz cannot read them. Sign-in tokens are signed with HMAC-SHA256 and expire after seven days. Every authenticated request re-reads the account's status and role from the database rather than trusting the token's claims, so deactivating a user or demoting an administrator takes effect on their next request instead of a week later.

Secrets — provider API keys, the mail password, the signing key — are mounted into the running container from files on the host and are not present in source control. No credential has ever been committed to the repository.

07 — What is stored, and where

Everything cogz holds lives in one PostgreSQL database on a single Hetzner host in the United States. That includes transcript turns, discovery answers, uploaded evidence files, generated deliverables and account records. Nightly encrypted backups go to Cloudflare R2 with a 30-day retention.

cogz does not encrypt individual database fields at the application layer. Transcripts and uploaded documents are stored as ordinary database values. Field-level encryption would protect against a stolen disk and against nothing else in this product's actual threat model — a mistake in a query, an over-broad access grant, a stolen token — and cogz would rather spend the effort where the risk is and tell you that than describe a control that reads well and does little.