Security
Your login stays yours
You sign in yourself. We keep only the session, scoped to the actions you allow.
How we hold your access
Your password never reaches us. Only the session goes into the vault.
-
No stored passwords
Only the session, encrypted with AES-256.
-
One isolated session per user and app
Never shared between users.
-
The model never sees a login
Agents call tools, not sessions.
-
No payload retention
Data passes through. Nothing is kept.
Scoped consent, action by action
Agents can only do what you ticked.
-
You pick the actions
Read-only, or read and write.
-
You pass MFA yourself
We never bypass it or ask for codes.
-
Revoke in one click
Access ends at once.
What we never do
-
Break CAPTCHAs
-
Bypass MFA
-
Automate banks without a licence
-
Touch LinkedIn or Instagram
-
Keep going after a cease-and-desist
-
Store your data longer than the call
If a site objects
-
Cease-and-desist arrives
The app owner asks us to stop.
-
Paused within 24 hours
The integration stops for everyone.
-
Your credits refunded
Affected credits come back to you.
On the roadmap
Planned, not done yet. We will say when they ship.
- Planned
SOC 2 Type II
Independent audit of our controls.
- Planned
EU data residency
Vault and sessions hosted in the EU.
- Planned
Service accounts
Add a Cotlet user to your team app instead of your own login.
Security questions
Do you store my password?
No. You sign in to each app yourself. We keep only the session in an AES-256 vault, and you can revoke it anytime.
Can you see my data?
Data passes through a call and is not retained. We keep no payloads after the call ends.
What happens when my session expires?
Your agent tells you to reconnect and you sign in again yourself. We never log in for you.
Where are the servers?
In the European Union: the console, API, database and session vault run in a data centre in Finland. Our CDN serves the public site worldwide.
Automate without handing over the keys
Request access and pick your apps. We email you when your account is ready.