Do you have a SOC 2 report?

No, we do not hold a SOC 2 report. We hold ISO 27001:2022, certificate 25-07-21156763, independently audited by Anglia Compliance Group in the UK. The two frameworks overlap heavily, and we supply a control mapping so your reviewer can compare them. If your policy names SOC 2 specifically, we cannot meet it, and we will tell you so at the first call.

How does the time difference work with a US team?

Engineers assigned to a US engagement work a shifted day covering 09:00–12:30 ET, which is 19:30–23:00 IST in winter and 18:30–22:00 IST during US daylight saving, and that shift is named in the engagement. India is nine and a half to thirteen and a half hours ahead of the United States, depending on your coast and the time of year, so a standard Indian working day has no overlap with yours. Standups, reviews and demos sit inside the shifted window, and written reporting covers the rest of your day.

What stops us being locked in if the relationship ends?

Your repositories, cloud accounts, domains and third-party service subscriptions are created in your name from day one wherever possible, so nothing has to be transferred when the relationship ends. Every engineer who touches the work is under a written assignment to Cognimit, which makes our assignment of the work to you enforceable. Escrow can be arranged where your risk register calls for it. Runbooks and architecture notes are contractual deliverables, so another team can continue the work without us.

Can you sign a HIPAA business associate agreement?

Yes, we sign a HIPAA business associate agreement where the engagement touches protected health information. The BAA is signed before any PHI is exchanged, access is limited to named engineers on the engagement, and the data residency region is fixed in the agreement.

United States · Global delivery09:00–12:30 ET (shifted)USD

Engineering for US companies.

The United States is the world's largest market for outsourced engineering, and US vendor reviews ask for evidence. We put three things in front of a reviewer: an audited information security management system, IP assigned to you on payment, and a written scope before anyone writes code. All three are published and apply to every engagement.

Start a project Verify our certifications

Working with the US

Hours, money,
and paperwork.

The three things that decide whether a cross-border engagement works. Everything here is specific to the US.

Time overlap

09:00–12:30 ET (shifted)

Our standard day is 10:00–18:00 IST, which is 23:30–07:30 ET, so it has no overlap with a US working day. Engineers on a US engagement work a shifted day to hold 09:00–12:30 ET, which is 19:30–23:00 IST while US clocks are on standard time and 18:30–22:00 IST during daylight saving. That shift is a staffing commitment written into the engagement. Standups, reviews and demos sit inside it; everything else runs on written reporting. West Coast teams take the same window at 06:00–09:30 PT.

Currency and tax

USD

Quoted and invoiced in US dollars via wire transfer or online gateway. Indian tax does not reach your invoice: exported services are zero-rated at source. We are not a US entity, so no US sales tax is charged either. Your finance team will usually want a Form W-8BEN-E on file for withholding purposes, and we provide it before the first invoice.

Data protection

Governing law: CCPA / CPRA, plus state privacy statutes
Authority: California Privacy Protection Agency and state attorneys general
Our role: Processor, on your instructions
Named sub-processors, written consent before any addition.

We act as a service provider under CCPA/CPRA: your data is processed only on your instructions, never sold, and never shared for cross-context behavioural advertising. Where an engagement touches health data we work to a HIPAA business associate agreement, and where it touches cardholder data we scope to PCI DSS boundaries agreed in writing before build.

City by city

Local hours and
local rules.

The shared working window in local time, and any rule that applies in a city on top of the national ones.

New York
New York
09:00–12:30 ET
Eastern Time
The SHIELD Act sets data security duties for anyone holding New York residents' private information. Financial firms regulated by NYDFS also work under its cybersecurity regulation, 23 NYCRR Part 500, which reaches their third-party service providers.
Boston
Massachusetts
09:00–12:30 ET
Eastern Time
Massachusetts regulation 201 CMR 17.00 requires a written information security programme for Massachusetts residents' personal information, including oversight of service providers.
Chicago
Illinois
08:00–11:30 CT
Central Time
The Illinois Biometric Information Privacy Act requires written consent before a business collects biometric identifiers such as face geometry, fingerprints or voiceprints. It applies to any feature where your system captures or stores them.
Austin
Texas
08:00–11:30 CT
Central Time
The Texas Data Privacy and Security Act, in force since July 2024, gives Texas residents rights over their data and requires a written contract with processors such as us.
Dallas
Texas
08:00–11:30 CT
Central Time
The Texas Data Privacy and Security Act applies, as in Austin, including the processor contract it requires.
Denver
Colorado
07:00–10:30 MT
Mountain Time
The Colorado Privacy Act, in force since July 2023, applies above its volume thresholds and requires processors to work under a contract that sets out the processing.
San Francisco
California
06:00–09:30 PT
Pacific Time
California's CCPA, as amended by the CPRA, is enforced by the California Privacy Protection Agency and the state Attorney General. We work as a service provider under it, with a contract that limits our use of your data to the services.
Los Angeles
California
06:00–09:30 PT
Pacific Time
The CCPA and CPRA apply, as in San Francisco, with us acting as a service provider.
Seattle
Washington
06:00–09:30 PT
Pacific Time
Washington's My Health My Data Act covers consumer health data outside HIPAA, including data collected by apps, and requires separate consent to collect and to share it.
Washington, D.C.
District of Columbia
09:00–12:30 ET
Eastern Time
Federal agencies buy cloud services through FedRAMP-authorised offerings, which we do not hold. We take commercial and non-federal work here.
Arlington
Virginia
09:00–12:30 ET
Eastern Time
The Virginia Consumer Data Protection Act, in force since January 2023, requires a written contract between controllers and processors such as us.
Jersey City
New Jersey
09:00–12:30 ET
Eastern Time
The New Jersey Data Privacy Act, in force since January 2025, requires a processor contract and gives residents rights over their data.
Philadelphia
Pennsylvania
09:00–12:30 ET
Eastern Time
National rules apply, with no city-specific additions.
Baltimore
Maryland
09:00–12:30 ET
Eastern Time
The Maryland Online Data Privacy Act, in force since October 2025, limits collection to what is reasonably necessary for the service requested, which shapes data models from the start.
Atlanta
Georgia
09:00–12:30 ET
Eastern Time
National rules apply, with no city-specific additions.
Raleigh
North Carolina
09:00–12:30 ET
Eastern Time
National rules apply, with no city-specific additions.
Miami
Florida
09:00–12:30 ET
Eastern Time
The Florida Digital Bill of Rights reaches only very large businesses, so most Florida clients work under federal and sector rules.
Indianapolis
Indiana
09:00–12:30 ET
Eastern Time
The Indiana Consumer Data Protection Act, in force since January 2026, requires a contract with processors.
Nashville
Tennessee
08:00–11:30 CT
Central Time
The Tennessee Information Protection Act, in force since July 2025, gives businesses a defence where their privacy programme follows the NIST Privacy Framework.
Minneapolis
Minnesota
08:00–11:30 CT
Central Time
The Minnesota Consumer Data Privacy Act, in force since July 2025, asks controllers to keep a data inventory and to bind processors by contract.
Houston
Texas
08:00–11:30 CT
Central Time
The Texas Data Privacy and Security Act applies, as in Austin.
Salt Lake City
Utah
07:00–10:30 MT
Mountain Time
The Utah Consumer Privacy Act, in force since December 2023, applies above its revenue and volume thresholds.
San Jose
California
06:00–09:30 PT
Pacific Time
The CCPA and CPRA apply, as in San Francisco.
San Diego
California
06:00–09:30 PT
Pacific Time
The CCPA and CPRA apply, as in San Francisco.
Portland
Oregon
06:00–09:30 PT
Pacific Time
The Oregon Consumer Privacy Act, in force since July 2024, requires a written contract with processors.

What your procurement will ask

Answered
before you ask.

The questions procurement teams in the US typically ask, with our answers. Where we do not hold something, the answer says so.

SOC 2 report

We do not hold SOC 2. We hold ISO 27001:2022, whose control families overlap substantially with SOC 2, and we provide a mapped control summary so your reviewer can compare the two. If your policy requires SOC 2 specifically, we cannot meet it, and we will tell you so before you start a review.

Security questionnaire

We aim to return a completed questionnaire within three working days, with the ISO 27001 certificate number so a reviewer can verify it independently. Any control we have not implemented is answered as not implemented.

IP assignment and work-for-hire

Custom code, designs and infrastructure definitions assign to you on payment. Pre-existing Cognimit libraries are licensed perpetually and non-exclusively for that product. Open-source components stay under their own licences, listed in a manifest at handover.

Insurance and indemnities

The professional indemnity and cyber cover you require, and the limits that apply, are agreed and written into the MSA at contract. Mutual indemnities for IP infringement and confidentiality breach are standard.

Certificate numbers, accreditation status and the verification route are published on our trust page. Check them without asking us.

Work we take on in the US

Common problems
we build for.

Common work for teams in the US. If one of these is yours, send us a brief.

Series A to C platform work

A first product that found traction on architecture that will not carry the next order of magnitude. The work is re-platforming the monolith into service boundaries while your team keeps shipping.

AI moved from demo to production

A model behind an internal prototype that now needs evaluation harnesses, cost and latency budgets per call path, and outputs traceable to a source before legal will sign off.

Team extension without a US hire

A US engineering lead who needs three more engineers this quarter and cannot fund three US salaries. Named engineers inside your repository on a monthly allocation, no recruitment fee.

Dedicated engineers

Why we suit teams in the US

ISO 27001:2022 with a published certificate number that you can verify with the UK certification body without contacting us.
A written recommendation covering scope, non-scope, model and cost within three to five working days of a brief.
We build three software products of our own: Aurelia, now in beta, and Voyazio and AxleOne, both in development. They are held to the same engineering standard we describe here.

Where we are not the right answer

We have no US entity, no US office and no US bank account. Contracts are cross-border with India as the governing jurisdiction unless we agree otherwise. The overlap depends on engineers working a shifted evening in India and covers three and a half hours of your day. If your procurement requires a domestic supplier, or your team needs all-day live availability, we are the wrong answer and will tell you on the first call.

United States · Questions

Asked from
the US.

General questions about pricing, process, IP and security are answered on the FAQ page.

Do you have a SOC 2 report?: No, we do not hold a SOC 2 report. We hold ISO 27001:2022, certificate 25-07-21156763, independently audited by Anglia Compliance Group in the UK. The two frameworks overlap heavily, and we supply a control mapping so your reviewer can compare them. If your policy names SOC 2 specifically, we cannot meet it, and we will tell you so at the first call.
How does the time difference work with a US team?: Engineers assigned to a US engagement work a shifted day covering 09:00–12:30 ET, which is 19:30–23:00 IST in winter and 18:30–22:00 IST during US daylight saving, and that shift is named in the engagement. India is nine and a half to thirteen and a half hours ahead of the United States, depending on your coast and the time of year, so a standard Indian working day has no overlap with yours. Standups, reviews and demos sit inside the shifted window, and written reporting covers the rest of your day.
What stops us being locked in if the relationship ends?: Your repositories, cloud accounts, domains and third-party service subscriptions are created in your name from day one wherever possible, so nothing has to be transferred when the relationship ends. Every engineer who touches the work is under a written assignment to Cognimit, which makes our assignment of the work to you enforceable. Escrow can be arranged where your risk register calls for it. Runbooks and architecture notes are contractual deliverables, so another team can continue the work without us.
Can you sign a HIPAA business associate agreement?: Yes, we sign a HIPAA business associate agreement where the engagement touches protected health information. The BAA is signed before any PHI is exchanged, access is limited to named engineers on the engagement, and the data residency region is fixed in the agreement.

Other markets