Security at Cognify Works

We use layered technical and operational controls appropriate to the services being provided. Managed IT, Microsoft services, hosted products, and custom solutions do not all use identical environments or controls.

Our approach typically includes:

• identity and access management based on role and need
• least-privilege and role-based access principles
• cloud and platform security appropriate to the environment
• secure development practices and environment separation where we build or operate software
• monitoring, logging, and backups appropriate to the service
• reducing unnecessary data collection
• reviewing data flows before production use

Where we operate or administer technology environments, we apply identity and access practices such as least-privilege access, role-based permissions, and multi-factor authentication where appropriate. Access is limited based on role and need. Customer-managed environments follow the access model defined for that engagement.

Cognify Works often works in Microsoft-centered environments. Depending on the engagement, that work may include Microsoft Entra identity and MFA, Conditional Access, Microsoft Defender, Microsoft Intune, Azure security controls, and Microsoft 365 security configuration.

Not every customer uses every Microsoft product. Microsoft does not certify or guarantee Cognify Works through this page.

For software and hosted solutions we build or operate, we use practices such as environment separation, secrets management, and review of data flows before production use. Operational controls may also include monitoring, audit logging, and backups appropriate to the service. These practices are applied according to the architecture and scope of the work, not as a single identical control set across every product or customer environment.

For the public website, we collect only the information needed to respond to inquiries, understand website usage, and protect the site from abuse.

See our Privacy Policy for more detail.

Some Cognify Works products and custom solutions may process business, operational, education, MSP, IT service, or workflow data. Those engagements require separate written agreements that define:

• data ownership
• permitted use
• hosting responsibilities
• access controls
• retention expectations
• support responsibilities
• data processing obligations

Some hosted products may support education or other regulated workflows. We do not claim blanket compliance or certification from this website alone. Compliance responsibilities, including FERPA-related handling where applicable, must be addressed in the customer agreement and implementation process.

When AI is used in a customer solution, the intended use, data flow, model behavior, review process, and guardrails should be defined during implementation. We avoid treating AI as a black box for business-critical decisions without appropriate oversight.

Cognify Works may use cloud hosting, email, analytics, storage, AI model providers, and other vendors to operate the website and deliver services. Customer-specific vendor and subprocessor details should be addressed in the relevant agreement or data processing terms.

If a security issue affects customer data, we follow incident-response principles appropriate to the situation. Response obligations and notification procedures follow the applicable customer agreement and legal requirements.

For security questions, contact hello@cognify-works.com.