Two self-hosted platforms for regulated technology teams. cognita dev takes every IT change from IT Committee approval to post-implementation review through seven gates. cognita grc runs audits, assessments, controls and inventories in one audited workspace.
cognita grc · /
cognita dev · /projects/PRJ-2026-036
Each product stands on its own and runs on your own infrastructure. Together they cover how change is made and how risk is governed, with one interface, one security model and one way of working with AI.
cognita dev
AI drafts each SDLC deliverable from the project's own records. People review, approve and sign off with an electronic signature. The traceability matrix, readiness checks and gate rules are computed, and auditors get an evidence pack they can verify offline.
cognita grc
Audits and exams, issues and regulator responses. Control and policy catalogues. GLBA, FedLine and security assessments. Monthly risk indicators. Asset, identity and data-flow inventories. Business impact analysis and incident response plans. About thirty AI actions draft, score and review the work, and your people sign in with Active Directory, SAML or OpenID Connect.
cognita dev governs how software changes are delivered. cognita grc governs the controls, risks and obligations those changes live under. Underneath, both run on the same stack and the same rules.
Delivery
Shared foundations GovernanceThe products run independently: deploy one or both. They share design, security model and technology, not a database.
AI in the suite writes first drafts, reviews work and proposes links. It never submits, approves, signs off or changes a record on its own, and every call is governed and logged.
In cognita dev, AI drafts land as new versions labelled AI-generated until a person edits them; only people submit, approve and sign. In cognita grc, AI results stay drafts until an editor saves them.
Every model call goes through a single server-side point. cognita dev adds an allowlist by role and data classification, token budgets and an emergency stop; cognita grc has a platform-wide kill switch that covers every AI action.
cognita dev works with Claude, Gemini or a model served on your own GPU with vLLM, and only the on-premises model may see Restricted data. cognita grc works with Gemini or the same kind of on-premises vLLM model, so prompts can stay on your hardware.
cognita dev records the model, prompt version, input hashes, tokens and cost of every call. Regulator responses in cognita grc cite only identifiers found in your evidence, and a QA pass flags any citation that does not check out.
Each audit event in cognita dev stores the hash of the one before it. Change any row and verification fails from that row on. The table refuses updates and deletes, and the application's database role can only insert and read it.
cognita dev · /audit
Auditors export an evidence pack per project: every signed-off deliverable, the RTM and its baselines, test evidence, security reports, approvals with their meaning statements, and the project's audit rows. A manifest lists each file's SHA-256, and a standard-library script verifies it offline.
How evidence is protected| Team | Works in | What they get |
|---|---|---|
| Developers and team leads | cognita dev | Deliverables drafted from project records, test cases generated from requirements, a clear list of what each gate still needs. |
| Department heads | cognita dev | Final sign-off, gate decisions and risk acceptances, and a portfolio of every project in their department. |
| IT risk and compliance | cognita grc | Controls, policies, KRIs and regulatory assessments with derived ratings instead of hand-built workbooks. |
| Information security and identity | Both | Security validation gates in delivery; privilege reviews, data-flow controls and tool assessments in governance. |
| Audit and exam liaison | Both | A read-only auditor role, searchable audit logs, evidence packs and regulator responses grounded in evidence. |
Both products run as Docker Compose stacks on your own hosts. Only the web proxy is published; the API, database and cache stay on internal networks.
No token ever appears in a response body. Failed sign-ins look identical whatever the reason, and accounts lock after repeated failures.
Every router except sign-in sits behind a session check, so a new route cannot ship unauthenticated. A test walks every route to prove it.
cognita dev encrypts backups, archives the write-ahead log hourly and runs a restore drill in CI. cognita grc takes scheduled snapshots with a verified manifest.
No. Both products are installed on infrastructure you control and run as Docker Compose stacks. Your records stay in your PostgreSQL database; the only outbound traffic is to the AI provider you enable, and cognita dev can run with no outbound traffic at all using an on-premises model.
No. cognita dev and cognita grc are independent applications. They share an interface, a security model and a technology stack, so running both is easier than running two unrelated tools, but either works alone.
cognita dev supports Anthropic Claude, Google Gemini and an on-premises model served with vLLM, plus a deterministic mock for testing. cognita grc supports Google Gemini and an on-premises model served with vLLM. In both, an administrator can switch AI off for everyone, and the rest of the product keeps working.
No. In cognita dev, AI cannot submit, approve or sign off, and its drafts are labelled until a person edits them. In cognita grc, AI output is a draft until someone with edit rights saves it.
The GLBA information security program (Interagency Guidelines and Regulation P, with NIST CSF 2.0 and NIST 800-53 mappings), the Federal Reserve FedLine Monitoring and Control Guidelines v3.1, and policy gap analysis against NIST CSF 2.0 or the OCC Cybersecurity Supervision Work Program.
In cognita grc, yes: register your Active Directory (LDAP), a SAML 2.0 identity provider or an OpenID Connect provider such as Microsoft Entra ID in Administration, and accounts are created on first sign-in with roles taken from directory groups. Local accounts with an authenticator remain for break-glass access. cognita dev uses local accounts with mandatory TOTP.
Both products have a read-only auditor role. cognita dev builds a per-project evidence pack with a SHA-256 manifest that can be verified offline, and its audit log is hash-chained. cognita grc keeps a searchable audit log with CSV export and produces PDF, Word and Excel reports in the shape reviewers expect.
Not in the current release. Both products use local accounts created by an administrator, with TOTP multi-factor authentication. There is no self-registration.
We will show a project moving through the gates in cognita dev and a regulator request answered in cognita grc, then talk through deployment on your infrastructure.
Product screenshots on this site show demonstration data.