# Deploy federated GraphQL in regulated industries from day one

Cosmo holds SOC 2 Type II certification and supports GDPR, HIPAA, and ISO 27001. Self-hosted Router, HMAC-signed configuration, RBAC, and SSO included.

## The problem

### Compliance takes time you don't have
Qualifying new infrastructure in regulated industries can take months. Every unvetted vendor is a gap in your audit trail.

### Regulated industries face long adoption cycles
Healthcare, finance, and government teams can spend months qualifying a new technology for production. Every new component means more auditor questions and more compliance documentation.

### Building compliant GraphQL from scratch is expensive
Security controls, audit logging, RBAC, SSO integration, and the processes to demonstrate them to auditors all require significant engineering investment when built in-house.

### Vendor compliance is part of your compliance posture
Your auditors ask about every third-party tool in your stack. A vendor without certifications creates a gap you have to fill with compensating controls and additional documentation.

## Our solution

### Compliance built into the platform
Cosmo's certifications, security controls, and documentation are already in place. Use them to satisfy your vendor compliance requirements rather than building the same controls from scratch.

### What Cosmo provides
1. **SOC 2 Type II certification** available as a report upon request for vendor due diligence.
2. **Supports GDPR, HIPAA, and ISO 27001** frameworks, enabling deployment in regulated industries.
3. **Self-hosted Cosmo Router**, keeping all request and response data within your infrastructure.
4. Configuration updates are **cryptographically validated** using HMAC-SHA256 signatures, preventing tampering.
5. Access is controlled through **RBAC and SSO** via OIDC and SAML.
6. Cosmo carries **$5M E&O and Cyber Insurance Coverage**.

## Compliance certifications

### Before & After
| Before Cosmo | With Cosmo |
| --- | --- |
| Months spent building compliant GraphQL infrastructure in-house | Deploy with enterprise-grade compliance controls from day one |
| Expensive custom security audits for your own federation solution | Use Cosmo's existing SOC 2 Type II certification to satisfy vendor due diligence |
| Uncertainty about what data leaves your infrastructure | Self-hosted Router keeps request data local; only anonymized metadata goes to the Control Plane |
| Complex compliance documentation built from scratch | Compliance reports and security documentation available upon request |

### Certifications and standards
- **SOC 2 Type II:** Report available upon request for vendor due diligence.
- **GDPR:** Data minimization, IP anonymization, and self-hosted Router deployment.
- **HIPAA:** Self-hosted infrastructure keeps PHI within your environment.
- **ISO 27001:** Information security management controls and documentation.

## How Cosmo meets enterprise security requirements

01. **Self-host**: Deploy the Cosmo Router inside your own infrastructure. Request and response data never leaves your environment.
02. **Config integrity enforced.**: Configuration updates pushed from the Control Plane are signed with HMAC-SHA256.
03. **RBAC and SSO built in.**: RBAC limits what each team member can view or change in Cosmo Studio.
04. **Audit docs ready on request.**: Request Cosmo's SOC 2 Type II report to document vendor compliance.

## Enterprise controls, included

### SOC 2 Type II certified
Cosmo holds a SOC 2 Type II certification. Request the report to satisfy vendor compliance requirements in your own audit process.

### HMAC-SHA256 config signing
Every configuration update from the Control Plane is cryptographically signed.

### SSO and RBAC
Connect your identity provider via OIDC or SAML. Role-Based Access Control limits permissions per team member in Cosmo Studio.

### Continuous fuzz testing
The Cosmo Router is continuously fuzz tested for security vulnerabilities.

### Webhook and URL validation
Webhook payloads are verified with SHA-256 signatures before processing.

### $5M E&O and Cyber Insurance
Enterprise Insurance Coverage provides additional risk mitigation for organizations with strict vendor risk requirements.

## Deploy GraphQL federation with compliance documentation ready

Request the SOC 2 Type II report and security documentation for your vendor review.