# Your login stays yours

> How Cotlet protects your accounts: no stored passwords, sessions in an AES-256 vault, scoped consent, no payload retention and apps we never automate.

Source: https://cotlet.dev/security

You sign in yourself. We keep only the session, scoped to the actions you allow.

[Read the acceptable-use policy](https://cotlet.dev/acceptable-use)

## How we hold your access

Your password never reaches us. Only the session goes into the vault.

You sign in once Encrypted vault AES-256 Isolated session per user and app The app human-paced calls AI model calls tools, sees no login You sign in once Encrypted vault AES-256 Isolated session per user and app The app human-paced calls AI model no password

- ### No stored passwords  
Only the session, encrypted with AES-256.
- ### One isolated session per user and app  
Never shared between users.
- ### The model never sees a login  
Agents call tools, not sessions.
- ### No payload retention  
Data passes through. Nothing is kept.

## Scoped consent, action by action

Agents can only do what you ticked.

Agent access Booking app, your account Read bookings Create booking Update client notes Delete clients MFA on your phone You approve each login Revoke access

- ### You pick the actions  
Read-only, or read and write.
- ### You pass MFA yourself  
We never bypass it or ask for codes.
- ### Revoke in one click  
Access ends at once.

## What we never do

- ### Break CAPTCHAs
- ### Bypass MFA
- ### Automate banks without a licence
- ### Touch LinkedIn or Instagram
- ### Keep going after a cease-and-desist
- ### Store your data longer than the call

## If a site objects

1. ### Cease-and-desist arrives  
The app owner asks us to stop.
2. ### Paused within 24 hours  
The integration stops for everyone.
3. ### Your credits refunded  
Affected credits come back to you.

## On the roadmap

Planned, not done yet. We will say when they ship.

- Planned  
### SOC 2 Type II  
Independent audit of our controls.
- Planned  
### EU data residency  
Vault and sessions hosted in the EU.
- Planned  
### Service accounts  
Add a Cotlet user to your team app instead of your own login.

## Security questions

### Do you store my password?

No. You sign in to each app yourself. We keep only the session in an AES-256 vault, and you can revoke it anytime.

### Can you see my data?

Data passes through a call and is not retained. We keep no payloads after the call ends.

### What happens when my session expires?

Your agent tells you to reconnect and you sign in again yourself. We never log in for you.

### Where are the servers?

In the European Union: the console, API, database and session vault run in a data centre in Finland. Our CDN serves the public site worldwide.

## Automate without handing over the keys

Request access and pick your apps. We email you when your account is ready.

[Request access](https://cotlet.dev/signup) [Browse integrations](https://cotlet.dev/integrations)