SaaS that passes the security review.
Software engineered for scrutiny.
Cognivus builds secure SaaS products for growing businesses, and assesses and strengthens the security of the systems they already run.
- Risk assessments follow NIST SP 800-30
- Written proposal within one business day
- NDA signed before any detailed discussion
| ID | Asset · issue | Risk |
|---|---|---|
| R-01 | Staff laptops · ePHI exports, no disk encryption | High |
| R-02 | Cloud admin accounts · password only, no MFA | High |
| R-03 | Database backups · restore never tested | Moderate |
Where are you starting?
Build a product
You need a web or SaaS product built, rebuilt or extended, and it has to survive an enterprise buyer's security questions.
- Access control, MFA and encryption from the first release
- Audit logging and dependency scanning before every launch
- Milestone demos and weekly written updates
Pass a security review
A customer, investor or regulator is asking how secure you are: a questionnaire, HIPAA, ISO 27001 or India's DPDP Act.
- Documented risk assessment with a prioritised plan
- Evidence you can show buyers and auditors
- We implement the fixes if you want
Services
Every engagement is scoped in writing and quoted at a fixed price for that scope.
All services- Secure SaaS developmentSecure SaaS development for startups and growing businesses: access control, encryption, audit logging and secure deployment built in from the first release.
- Security risk assessmentA documented security risk assessment following NIST SP 800-30: asset inventory, risk register, prioritised remediation plan and executive summary.
- Email and domain securityStop anyone from sending email that impersonates your domain.
- Web app security testingAuthorised testing of your web app and APIs: automated scanning with manual verification, following the OWASP method, with a clear report, fixes and a retest.
- HIPAA risk analysisThe HIPAA Security Rule requires an accurate and thorough risk analysis of ePHI.
- ISO 27001 readinessPrepare for ISO/IEC 27001:2022 certification: gap assessment, risk assessment and treatment, Statement of Applicability and the controls to close the gaps.
- DPDP Act readinessPrepare for India's Digital Personal Data Protection Act 2023 and DPDP Rules 2025: data inventory, notices, consent, security safeguards and breach response.
- Security questionnairesAnswer enterprise security questionnaires (SIG, CAIQ, custom) accurately and fast, with an evidence pack, and fix the gaps that would otherwise lose the deal.
- SOC 2 readinessGet ready for your SOC 2 audit: gap assessment, policies, controls and an auditor-ready evidence pack.
Read a complete report before you hire us.
Our sample risk assessment for a fictional health-tech company shows exactly what you receive: scope, method, risk register, remediation plan and framework mapping.
- Risk assessment report
- Risk register (spreadsheet)
- Prioritised remediation plan
- Two-page executive summary
How it works
Our approach20-minute call
Free · this weekWe listen to what you need, ask about your systems and deadline, and tell you honestly whether we are the right fit.
Written proposal
Within one business dayScope, deliverables, timeline and a fixed price for that scope. You know exactly what you get before work starts.
Delivery
3–5 weeks for an assessment · 6–12 weeks for a buildWeekly written updates, milestone demos and a daily overlap with your time zone. Read-only access wherever possible.
Report, handover and fixes
At the end of each engagementYou receive the report or the working product, walked through in a readout meeting. We can then implement the fixes or support you monthly.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.