Identity and SSO
Local accounts and enterprise OIDC establish stable user identities before any knowledge request is evaluated.
Security architecture
Control comes before intelligence.
CogLake treats search, preview, download, graph traversal, REST, and MCP as one authorization boundary. A useful answer is returned only after identity and access are resolved.
Default deny
01Identity02Policy03Evidence
Defense through the complete path
Permissions do not stop at the search box.
The same decision model protects direct document IDs, chunks, citations, original links, downloads, related graph nodes, API calls, and agent tools.
Scoped agent access
API keys and OAuth clients receive explicit scopes, expiry, rotation evidence, and revocation controls.
Layered authorization
Platform roles, workspace rights, connector grants, source ACLs, and public-link policy resolve centrally.
Verified retrieval
Fast candidate filtering is followed by authoritative API checks before content, originals, or graph paths leave the system.
Audit evidence
Administrative changes, searches, downloads, connector jobs, repairs, and agent activity remain attributable.
Repair and recovery
Permission drift repair, idempotent jobs, failed-document repair, encrypted backups, and restore probes support day-two operations.
European operating model
Technical controls for governed deployments.
CogLake supports EU-hosted managed environments, dedicated deployments, and on-premises operation. Deployment-specific legal assessment, policies, and formal certifications remain the responsibility of the operating organization.
- Data residency
- EU managed, dedicated, or customer-controlled on-premises boundaries.
- Model boundary
- Hosted, OpenAI-compatible, or local inference selected per deployment.
- Secrets
- Encrypted connector credentials with versioned key handling and rotation workflows.
- Recovery
- Encrypted exports, local snapshots, restore choices, and index rebuild controls.
No certification theatre. CogLake provides technical controls and deploys on ISO 27001-controlled infrastructure where contracted. We distinguish those controls from a product certification and document the selected boundary during evaluation.
Deployment optionsGovern the work, not only the lookup.
AI Workspace extends central administration to models, provider keys, MCP connections, skills and action approvals. Source access and tool execution remain separate permission decisions.
Start with your real knowledge
Evaluate security against your real boundary.
Bring your identity provider, source permissions, deployment constraints, and audit requirements to a focused technical review.
Book a walkthrough