How are credentials encrypted?

At rest: AES-256-GCM for credentials and metadata.
In transit: TLS 1.3 for every network hop, including DB traffic.
Keys: Rotated automatically; never exported outside your tenant.

AES-256-GCM at rest, TLS 1.3 in transit. Connection strings are never logged or cached in plain text.

Do you support SSH tunneling?

Yes. You can configure per-connection SSH jump hosts for databases behind bastions.

SOC 2 Type II is on our roadmap for 2026. Our architecture is designed against SOC 2 controls.

Feature · Security

Cocobox is engineered so the secure path is the easy path. Encryption, SSH tunneling, zero-knowledge AI, and full audit — out of the box.

Bring your own OpenAI / Anthropic / Gemini keys — traffic flows client-side. We never proxy or log AI prompts or completions.

Every query, share, token creation, and permission change is logged with timestamp, actor, IP, and outcome. Exportable to CSV or your SIEM.

SOC 2 Type II audit in 2026. Architecture designed to minimize data we hold and to meet GDPR, CCPA, and HIPAA-adjacent requirements.