Kosmoslabs Trust Center

generated: '2026-07-19'
method: searched
probe: true
source: https://trust.kosmoslabs.ai/ and https://kosmoslabs.ai/resources/security/
url: https://trust.kosmoslabs.ai/
description: >-
  Kosmos AI Labs, Inc operates a public Security Trust Center at trust.kosmoslabs.ai. IMPORTANT —
  it publishes a compliance PROGRAM, not achieved certifications: both SOC 2 Type 1 and SOC 2
  Type 2 are listed "In progress" and zero certifications are complete. An earlier automated probe
  of this page recorded "SOC 2, ISO 27001" from the trust-center vendor's boilerplate meta
  description ("...against common cybersecurity frameworks like SOC 2, ISO 27001, ISO 9001, and
  more"); that was a false positive and has been corrected. Kosmos does not claim ISO 27001
  anywhere.

trust_center:
  published: true
  url: https://trust.kosmoslabs.ai/
  title: Kosmos AI Labs, Inc - Security Trust Center
  status: 200
  probed: '2026-07-19'
  secondary_page: https://kosmoslabs.ai/resources/security/

certifications_achieved: []

certifications_in_progress:
- name: SOC 2 Type 1
  status: in progress
  target: >-
    "SOC 2 Type 1 targeted Audit engaged · Jun 2026" (security page); trust center FAQ states
    completion targeted for June 2026.
  evidence: Listed as "In progress" on trust.kosmoslabs.ai; audit engagement published.
- name: SOC 2 Type 2
  status: in progress
  evidence: Listed as "In progress" on trust.kosmoslabs.ai.

iso_27001:
  claimed: false
  note: >-
    Not claimed on the trust center or the security page. Present only in the trust-center
    vendor's generic meta-description boilerplate.

program_metrics:
  source: https://trust.kosmoslabs.ai/
  frameworks_tracked: 2
  controls_monitored: 35
  controls_note: Continuously monitored across infrastructure and processes.
  internal_policies: 25
  subprocessors_listed: 0
  documents_available: 0

penetration_testing:
  conducted: true
  detail: >-
    "Penetration testing is part of our SOC 2 preparation program. Results are available to
    customers" (trust center FAQ).
  public_report: false

security_testing:
  dast:
    published: true
    result: 0 findings High severity
    date: Mar 2026
    source: https://kosmoslabs.ai/resources/security/

dpa:
  available: true
  note: DPA requests routed to the security alias; trust center FAQ confirms a DPA is available.

questionnaires:
  supported: [VSA, CAIQ, custom questionnaires]
  sla: Five business days
  routing: Dedicated security alias (security@kosmoslabs.ai)
  source: https://kosmoslabs.ai/resources/security/

security_posture:
  encryption_in_transit: TLS 1.2+
  integration_scopes: OAuth 2.0 with read-only integration scopes by default
  trust_model: '"Machines propose. Humans confirm."'
  source: https://docs.kosmoslabs.ai/product-documentation/security-overview

related:
  domain_security: security/kosmoslabs-domain-security.yml
  vulnerability_disclosure: security/kosmoslabs-vulnerability-disclosure.yml
  conformance: conformance/kosmoslabs-conformance.yml