Is Cosmo SOC 2 certified?

Yes. WunderGraph holds a SOC 2 Type II certification for Cosmo and is also certified to ISO 27001:2022. You can request access to WunderGraph security documentation through the Trust Center at trust.wundergraph.com.

Can I run Cosmo without sending any data to WunderGraph?

Yes. The whole stack is open source under Apache 2.0, and you can self-host all of it: router, control plane, Studio, and the telemetry pipeline, on-premises or fully air-gapped. If you only self-host the router, load a static config file with ROUTER_CONFIG_PATH, leave GRAPH_API_TOKEN empty, and turn off tracing, OTLP metrics, and schema usage metrics. The router then sends no telemetry to Cosmo Cloud. Studio features that depend on that data stop working.

Does the router send client IPs or GraphQL variables to telemetry?

Not by default. Client IP addresses are redacted before any trace or log is written, and GraphQL variables are left out of traces unless you set export_graphql_variables to true. Inline values written into the query string are not covered, so use validate_inline_arguments to reject them and keep sensitive data in variables.

How long does Cosmo Cloud keep telemetry?

Retention depends on your plan. The Cosmo docs give 30 days for telemetry data and 90 days for schema usage data, and the pricing page lists the analytics window for each plan. Self-hosted deployments keep data for as long as you configure.

Which compliance frameworks does Cosmo support?

WunderGraph is SOC 2 Type II and ISO 27001:2022 certified. Cosmo also supports GDPR and HIPAA requirements through router-level privacy defaults and self-hosted deployment, which keeps request and response data inside your own infrastructure.

Cosmo Compliance

Compliance controls, built into Cosmo

IP anonymization, variable export control, and field-level data masking, enforced at the router with no subgraph changes. Every telemetry export is documented and can be switched off, and the whole stack can run inside your own infrastructure.

Start Free Read the Docs

SOC 2 Type II and ISO 27001:2022 certified. Supports GDPR and HIPAA requirements.

Overview

Privacy and security at the gateway

Cosmo compliance is the set of privacy and security controls built into the Cosmo Router and Cosmo Cloud platform. Controls operate at the gateway layer, which means they apply to every subgraph uniformly without touching individual services.

The default controls (IP anonymization and variable exclusion) activate automatically on every deployment. Advanced controls (field-level obfuscation via Custom Modules) are available on Pro and Enterprise plans. Compliance certifications and documentation are available for regulated industry deployments.

Data flows

What data leaves the router

Auditors ask what the gateway sends where. This is what the docs list, with the default and the setting that turns each one off. By default the router leaves client IPs and GraphQL variables out of telemetry, and the source for every row is the compliance and data management docs.

Export	What it contains	Default	How to change it
OpenTelemetry traces	Request host, user agent, protocol, and bytes; router process ID, hostname, and service name; operation name and the normalized query (no user data, unless values are written inline). Variables only if you opt in.	On, variables off	telemetry.tracing.enabled: false
OpenTelemetry metrics	Request counts, bytes, in-flight requests, latency, and runtime stats, by operation and subgraph.	On	telemetry.metrics.otlp.enabled: false
Schema usage metrics	Operation content and the GraphQL types each operation uses. Powers breaking-change checks and field usage.	On	graphql_metrics.enabled: false
Client IP addresses	Redacted before any trace or log is written. Hash mode keeps an anonymous identifier instead.	Anonymized	compliance.anonymize_ip.enabled: false (method: redact or hash)
Request logs	Method, path, query, user agent, anonymized client IP, router and config version, status, and latency. Written locally and never sent to an external system.	Local only	Not exported
Router config fetch	The router pulls its execution config from the Cosmo CDN and registers with the control plane on startup.	On with a graph token	Static config via ROUTER_CONFIG_PATH, no GRAPH_API_TOKEN

On Cosmo Cloud, retention depends on your plan. The pricing page lists the window for each plan. Switching exports off costs you the Studio features built on them, such as field usage and trace views. For how to read the data you keep, see Cosmo observability.

Data residency

Run Cosmo inside your audit boundary

Certifications cover WunderGraph. Many regulated teams also need the gateway itself inside their own boundary, and Cosmo is built for that. Every component is open source under Apache 2.0, so your security team can read the code before it ships.

Self-host the router only. Request and response data never leave your network. The router sends only the telemetry in the table above, and you decide which of it goes to Cosmo Cloud.

Self-host the whole platform. Run the control plane, Studio, and the telemetry pipeline on your own Kubernetes cluster, on-premises, in your cloud region, or fully air-gapped.

Run a router with no outside connection. Load the execution config from a file with ROUTER_CONFIG_PATH and leave GRAPH_API_TOKEN empty. The router then serves traffic without polling the CDN or exporting to Cosmo Cloud. The trade-off: every schema change needs a config update and a redeploy.

The router also guards the request path itself, for example by rejecting inline argument values so sensitive data has to travel as variables, which stay out of traces.

“Utilizing Cosmo's self-hosted router empowers us with direct control over our data. This enables necessary scalability according to our requirements and ensures absolute PCI compliance, a crucial aspect of our operations.”

Tyler Hawkins, Backend Tech Lead, TravelPass Group. Read the case study.

Why gateway-level compliance matters

Why teams choose compliance at the router

Distributed services make compliance expensive. Each subgraph implements its own controls independently, and gaps appear at every team boundary.

Teams managing compliance across federated GraphQL run into the same problems.

Privacy controls drift across services.

When each subgraph implements IP anonymization or variable filtering independently, the guarantees are uneven. One unconfigured service is a compliance gap.

PII ends up in telemetry by default.

Most OTEL instrumentation captures all span attributes. IP addresses and GraphQL variables land in your observability platform without explicit exclusion.

Field-level access control is expensive to maintain.

Adding masking logic to individual resolvers means touching every subgraph and keeping that logic in sync as schemas evolve.

Vendor qualification takes months.

Regulated industries require documentation for every component in the stack. A vendor without certifications creates a gap that requires compensating controls.

Cosmo enforces privacy and security at the router. One control point covers every subgraph behind it.

Cosmo Compliance capabilities

IP Anonymization

IP addresses are anonymized before any trace or log is written. Choose redact (complete removal) or hash (one-way identifier for anonymous analytics). Enabled by default with no configuration required.

Free / Pro / Enterprise

Variable Export Control

GraphQL variables are excluded from OTEL trace exports by default. Sensitive request data stays out of your observability platform unless you explicitly enable capture for debugging or query replay.

Free / Pro / Enterprise

Use cases

GraphQL compliance use cases

Real scenarios from regulated industries and privacy-conscious teams, and the Cosmo control behind each one.

GDPR

Deploy GraphQL analytics without capturing user IPs

Scenario

A European SaaS platform needs full API analytics but cannot store raw IP addresses under GDPR data minimization rules.

How Cosmo handles it

Deploy the Cosmo Router with default settings. IP addresses are anonymized before any telemetry export. Switch to hash mode if you need anonymous user session tracking across requests.

Outcome

Full analytics with no raw IP addresses in any telemetry sink. Data minimization for GDPR is supported at the infrastructure level.

Financial services

Keep transaction variables out of distributed traces

Scenario

A fintech company processes transactions via GraphQL. Variables contain account numbers, amounts, and user identifiers that should not appear in trace data.

How Cosmo handles it

Deploy the Cosmo Router with default variable export settings disabled. Traces capture operation names, timing, and error details. Variables are stripped automatically.

Outcome

Full observability into API performance without sensitive transaction data appearing in the observability platform or SIEM.

AI integration

Expose GraphQL to AI models without PII leakage

Scenario

A team wants to allow AI models to query their GraphQL API for non-sensitive use cases but needs to prevent access to fields like SSNs or medical information.

How Cosmo handles it

Implement a Custom Module with a field-value renderer that identifies AI system requests by header or authentication claims. Protected fields return placeholder values; other fields are unaffected.

Outcome

AI models interact with realistic response structures. Sensitive fields return placeholders. No subgraph changes required.

Audit

Pass a SOC 2 vendor review for GraphQL infrastructure

Scenario

A fintech company needs to include their GraphQL gateway in a SOC 2 Type II audit scope and demonstrate vendor compliance.

How Cosmo handles it

Request access to WunderGraph's security documentation through the Trust Center. Reference built-in controls: IP anonymization, variable exclusion, RBAC, HMAC-signed configuration, and SSO integration. Self-hosted Router keeps request data within the audit boundary.

Outcome

Vendor compliance section of the audit completed with documented controls and two existing certifications.

Which compliance capability do you need?

If you are…	Start here
Need to anonymize IP addresses in telemetry by default	IP Anonymization
Preventing sensitive variables from appearing in traces	Variable Export Control
Masking response fields by user role without subgraph changes	Advanced Data Privacy
Deploying GraphQL in healthcare, finance, or government	Compliance Certifications
Need SOC 2 Type II or ISO 27001:2022 documentation for a vendor review	Compliance Certifications
Exposing GraphQL to AI systems while protecting sensitive fields	Advanced Data Privacy

How Cosmo Compliance compares

	Cosmo	Apollo Router	DIY / subgraph-level
IP anonymization by default	Yes (all plans)	Manual	Per-service
Variable exclusion from traces	Yes, excluded by default	Manual	Manual
Field-level obfuscation	Custom Modules (Pro/Enterprise)	Manual	Per-resolver
SOC 2 Type II certification	Yes	Yes	Self-built
Self-hosted Router for data isolation	Yes	Yes	N/A
Config integrity signing	HMAC-SHA256	N/A	N/A

Why teams trust Cosmo for compliance

Privacy controls that activate by default. IP anonymization and variable exclusion work from the first request. There is no configuration step to remember.
One control point for every subgraph. Compliance logic at the router applies uniformly. Adding a new subgraph does not require a new round of privacy configuration.
Certifications that speed up vendor review. SOC 2 Type II and ISO 27001:2022 certifications, plus documented GDPR and HIPAA support. Request access to security documentation through the Trust Center.

Cosmo compliance FAQ

Is Cosmo SOC 2 certified?: Yes. WunderGraph holds a SOC 2 Type II certification for Cosmo and is also certified to ISO 27001:2022. You can request access to WunderGraph security documentation through the Trust Center at trust.wundergraph.com.
Can I run Cosmo without sending any data to WunderGraph?: Yes. The whole stack is open source under Apache 2.0, and you can self-host all of it: router, control plane, Studio, and the telemetry pipeline, on-premises or fully air-gapped. If you only self-host the router, load a static config file with ROUTER_CONFIG_PATH, leave GRAPH_API_TOKEN empty, and turn off tracing, OTLP metrics, and schema usage metrics. The router then sends no telemetry to Cosmo Cloud. Studio features that depend on that data stop working.
Does the router send client IPs or GraphQL variables to telemetry?: Not by default. Client IP addresses are redacted before any trace or log is written, and GraphQL variables are left out of traces unless you set export_graphql_variables to true. Inline values written into the query string are not covered, so use validate_inline_arguments to reject them and keep sensitive data in variables.
How long does Cosmo Cloud keep telemetry?: Retention depends on your plan. The Cosmo docs give 30 days for telemetry data and 90 days for schema usage data, and the pricing page lists the analytics window for each plan. Self-hosted deployments keep data for as long as you configure.
Which compliance frameworks does Cosmo support?: WunderGraph is SOC 2 Type II and ISO 27001:2022 certified. Cosmo also supports GDPR and HIPAA requirements through router-level privacy defaults and self-hosted deployment, which keeps request and response data inside your own infrastructure.

Full detail in the security and compliance docs.

Get started

Run compliant GraphQL federation on the Cosmo Router

Start Free Read the Docs