Security & trust
Security your compliance team can sign off
Your organisation · security
Protected- Access
- Invitation only
- Sign-in
- Two-factor (TOTP)
- Permissions
- Admin · Supervisor · User
- Data isolation
- Row-level security
- Transport
- HTTPS + HSTS
- Activity
- Audit logged
ICO registration ZB738672 · Skynet Solutions Ltd
Controls
The protections in place today
No roadmap promises — these are the controls built into the COSA app your team would use.
Access
- Accounts
- Invitation onlyNobody can sign themselves up to your organisation. People join only when one of your admins invites them.
- Permissions
- Admin · Supervisor · UserRoles decide who can see, change and export what inside your organisation.
- Sign-in
- Two-factor (TOTP)One-time codes from any authenticator app add a second step to every sign-in that enables it.
Data
- Isolation
- Row-level securityEach firm's calls, clients and results are kept separate from every other firm's in the database.
- Transport
- HTTPS + HSTSAll traffic is encrypted in transit, with strict transport security enforced in production.
- Browser
- Content security policyLimits where scripts, media and connections load from; frame protections guard against clickjacking.
Accountability
- Activity
- Audit loggedLogins, uploads, exports and overrides are recorded against a named user and a time.
- Overrides
- Original verdict keptA reviewer's decision is recorded next to what the assessment said, and re-runs never replace it.
- Integrations
- Scoped, revocable keysAPI keys are limited to the data they need, and an admin can revoke one at any time.
Data journey
How a call moves through COSA
From the moment a call ends to the evidence in your file — every step is controlled, attributable and reviewable.
- 01
The call ends
Your dialler sends the finished recording, or your team uploads it. COSA Compliance never joins or interrupts a live call.
- 02
It's transcribed
Speech becomes a timestamped transcript your reviewers can search and jump through.
- 03
It's assessed
Every rule that applies to the call type is checked, with the quote, the reasoning and a confidence score.
- 04
Your team reviews
Reviewers confirm or override flagged results. Overrides are logged and the original verdict is kept.
- 05
It's evidenced
Reports and client packs are exported on demand, and every export is written to the audit log.
Responsible AI
AI that shows its working
A compliance decision you can't explain is a liability. COSA is built so every result can be checked, challenged and traced back to the call. For the wider picture, see how AI call monitoring works and how to roll it out.
- 01
Your rules, your standards
COSA checks calls against the rules your compliance team writes — not a generic template it can't explain.
- 02
Evidence with every verdict
Each result carries the quoted words, a written explanation and a confidence score, so it can be checked in seconds.
- 03
People have the final say
Authorised reviewers can override any result. The original verdict stays on record for the audit trail.
- 04
Coverage you can prove
Every in-scope call is assessed, and every call you exclude is logged with the reason. No unexplained gaps.
- Assessments
- 1,284
- last 30 days
- Compliance rate
- 91%
- ↗ 4 pp vs prior
- Needs review
- 37
- 3% of calls
1 result on this check was manually overridden by an authorised reviewer. The original verdict is retained for audit purposes.
Client Pack · Margaret Hughes
Every report, transcript and summary in one ZIP
- compliance/
- transcriptions/
- summaries/
Supplier due diligence
Onboarding a new supplier? We'll make it straightforward
Your risk and compliance teams will have questions before COSA goes near a client call. Send them our way — we'll walk through the detail with the people who need it. Our buyer's guide to AI call monitoring software includes the security and data questions to ask any supplier.
Topics we cover in a security review
- User access, roles and two-factor authentication
- How each firm's data is isolated
- What the audit log records
- Integrations, API keys and data flows
- How AI verdicts are produced, checked and overridden
- Data retention and deletion
- Company and ICO registration details
The company behind COSA
- Legal entity
- Skynet Solutions Ltd, trading as COSA AI
- Company number
- 15086136 (England & Wales)
- Registered office
- 25-29 Sandy Way, Yeadon, Leeds LS19 7EW
- ICO registration
- ZB738672
FAQ
Security questions we're asked most
Does COSA listen in to live calls?
No. COSA Compliance only processes a call once it has finished — it can't join or interrupt one. Your advisers keep working exactly as they do today.
Who can see our calls and results?
Only people your admins have invited to your organisation, within the permissions of their role. Each firm's data is isolated at the database level, so it is never visible to another firm.
How accurate is it — and who makes the final decision?
Every verdict comes with a written explanation, the quoted evidence from the transcript and a confidence score, so a reviewer can check it in seconds. COSA supports your team's judgement rather than replacing it: authorised reviewers can override any result, and the original verdict is kept for the audit trail.
Is activity logged?
Yes. Logins, uploads, exports and overrides are recorded in an audit log, so you can show who did what, and when. Overridden results keep their original verdict.
How is our data protected?
Accounts are invitation-only, with role-based permissions and two-factor authentication. Each firm's data is isolated at the database level, data is encrypted in transit, and logins, exports and changes are written to an audit log. COSA is operated by Skynet Solutions Ltd, registered with the ICO (ZB738672).
Does COSA support two-factor authentication?
Yes. Sign-in supports two-factor authentication with time-based one-time codes (TOTP) from any authenticator app, alongside invitation-only accounts and role-based permissions.
How are API keys for integrations controlled?
API keys are limited to the data they need, and an admin can revoke one at any time.
Bring your security questions to the demo
See the controls for yourself — user management, two-factor sign-in, overrides and the audit trail — on a walkthrough tailored to your firm.
- Tailored to your call types
- No obligation
- Reply within 24 hours