How Cosmo meets Compliance Requirements and Saves Onboarding Time
TL;DR
Cosmo shortens vendor due diligence because it is open source and can run fully on-prem, so many information security and privacy checks do not apply. Building security and privacy into the design from the start, rather than bolting them on later, is what keeps a compliance review from stalling a rollout for months. Because self-hosted Cosmo does not phone home, questions about unencrypted network data, WunderGraph employee access, and where the data is hosted often become not applicable, since the customer runs the whole thing independently. Open source adds transparency, customizability, community review, and reliance on open standards, and running on-prem also lets teams reuse existing infrastructure and avoid egress cost at billions of requests per month.
One of the most frustrating things when introducing a new software or working with a new vendor is the due diligence process to satisfy information security and privacy requirements. You made a decision, but then things are being slowed down by the compliance review process where all you want is to get going and show some results. Fortunately, Cosmo is an easy sell to your CISO / legal team. This is why.
State of GraphQL Federation 2026
How are teams governing schema changes, handling production traffic, and measuring Federation success? Share your experience and get early access to the full report. For every valid survey completed, we'll donate $30 to UNICEF .
I've been there, and I feel you. :) If you work as a dev, it's super easy to just sign up for some cool service, check it out, and then decide that you want to use it because it makes your life so much easier (and, after all, it's cool, right?). You talk to your manager, she agrees, budget is approved, and then there's this tiny final step where you're talking to your compliance folks. And then the fun starts.
Of course, due diligence is a good idea for new software and new suppliers, don't get me wrong. While it can be a pain in the rear, it safeguards your company from costly mistakes and potential legal implications. However, these checks take their time, and you better not try to rush it. So what can you do to make sure you're not stuck in a process taking months for a solution you need now?
Simple answer: look for the right software where security and privacy - core components for compliance - are part of the design and built-in from the ground up.
When we created Cosmo, we knew that the solution would be running at the core of business operations, passing sensitive data between services. Having built our WunderGraph API Integration SDK before gave us a head-start, also because we were able to talk with many users of the BFF framework about their needs in their specific set-up.
We believe in open-source software, also because it has several advantages over closed-source / proprietary software when it comes to compliance:
- Transparency: anyone can review / audit the code
- Customizability: changes can be made to meet specific requirements
- Community: lots of eyeballs being able to spot security flaws or anything fishy you wouldn't want in your software (shitstorm guaranteed!)
- Open Standards: tasks like authentication are handled by relying on open standards / OSS software, too
In other words, we decided to build Cosmo and its components from the ground up with security, privacy and thus regulatory compliance in mind. And, most importantly, with the ability to run Cosmo fully on-prem.
From our existing customers and users, we know how important it is to be able to run critical software in your own infrastructure, with no dependencies to any outside service. For teams with strict data residency requirements, this extends to router artifacts — Cosmo's storage providers feature lets you store execution configs and persisted operations in your own S3 buckets. If you're an enterprise, you'd want this for two reasons: compliance (obviously), but also to leverage your existing infrastructure and not have massive egress cost, which becomes a factor if you're handling billions and billions of requests per month.
So in contrast to our main competitor, we made absolutely sure that you wouldn’t need some Cloud service to run Cosmo, but to make it optional. This decision was difficult for two reasons:
- Our competition does it, so the market obviously accepts it (to a certain degree), and it's a great lever to make money
- Giving your software away basically for free doesn't allow us to build a relationship with the users and improve our software
As a start-up, it's all about runway, and removing all restraints for use of your software is a tough call to make. Yet, it is inevitable if you want to work with big enterprises for which compliance is more important than cost (or at least close to it ;).
Thanks to Cosmo's uniqueness in being able to run fully self-hosted, we are able to satisfy compliance concerns before they really arise. And what's even better, looking at the due diligence process: many of the items on the ISMS / ISO 27001 checklist can be simply ticked off because they don't apply to Cosmo.
Does Cosmo send unencrypted data over the network? No, because it doesn't phone home at all. Which WunderGraph employees need access to Cosmo, and how is access being restricted and controlled? Not applicable, as the customer runs the whole thing independently. Where is the data being hosted, Europe or US? Wherever the customer cares to keep his data. And so on.
For internal auditors, Cosmo makes their job very simple as only a few controls need addressing and documenting. This helps to keep the process quite fast and streamlined compared to traditional software compliance audits.
On the engineering side, it ensures that devs can start leveraging Cosmo and GraphQL Federation quickly, without long waiting times for the green light from the compliance team. Usually when organizations look at Cosmo, there’s some pressure to produce tangible results, so this can make all the difference between being able to ship in a few weeks or a few months with traditional software.
Frequently Asked Questions (FAQ)
Open source brings four things a compliance team cares about: transparency, since anyone can review and audit the code; customizability, since changes can be made to meet specific requirements; community review, since many eyes are more likely to spot a security flaw; and reliance on open standards for tasks like authentication.
When the customer runs the whole thing in their own infrastructure, many items on an ISMS or ISO 27001 checklist can be ticked off because they do not apply. Cosmo does not phone home, so it sends no unencrypted data over the network; no WunderGraph employees need access; and the data is hosted wherever the customer chooses to keep it.
From the start. The advice is to look for software where security and privacy, the core components of compliance, are built in from the ground up, so a review does not leave you stuck in a process that takes months for a solution you need now.
Cosmo can run fully on-prem in your own infrastructure with no dependency on an outside cloud service. For teams with strict data residency requirements, Cosmo's storage providers feature also lets you keep router artifacts, such as execution configs and persisted operations, in your own S3 buckets.
Running Cosmo in your own infrastructure lets you reuse what you already have and avoid the egress cost that becomes a real factor once you are handling billions of requests per month.
COO & Co-Founder at WunderGraph
Björn Schwenzer is the COO and co-founder of WunderGraph, overseeing finance, legal, HR, information security, and day-to-day operations. He works closely with the team to ensure smooth operations, compliance, and execution of company strategy, drawing on extensive experience from previous C-level roles.
