Your login stays yours

No. You sign in to each app yourself, in your own Cloud Browser, and password saving and autofill are switched off there, so the password you type is not stored anywhere. What stays is the signed-in browser profile, encrypted with AES-256-GCM, the cipher 1Password uses for its vaults.

Yes, with free public scanners anyone can rerun: cotlet.dev gets A+ on Qualys SSL Labs, A+ on securityheaders.com and A+ on Mozilla Observatory, and Sucuri SiteCheck finds it clean on 9 blocklists. The domain is signed with DNSSEC, and every browser opens it over HTTPS only, because the whole .dev domain is on the HSTS preload list built into browsers. Your Cloud Browser profile is stored encrypted with AES-256-GCM, the same cipher 1Password uses for its vaults.

Email [email protected] with the details. The contact is also published in the standard security.txt file at cotlet.dev/.well-known/security.txt.

In your own Cloud Browser: a Chrome that runs on our servers and that you open from the console. Each app opens in its own window, locked to that app's pages: you sign in on its own sign-in page and pass its 2FA yourself. The browser runs on our side, so we say it plainly: what you type there passes through our servers, and password saving is off, so it is never kept.

A signed-in browser can do what you can do in that app, so we limit it on our side: agent tools reach only the apps you enable, read only or read and write, posts and messages wait for your OK by default, and every background request is listed in your Background activity with its time, app, tool and address.

Not for tools: they send the same requests your browser would, from its IP with its cookies, and each one is listed in your Background activity. When no tool does the job, your agent can drive one app's browser itself over Chrome DevTools. It then sees what that tab shows, cookies included, and tool scopes and approvals do not apply. That needs a key or connection with access to all apps and write, costs credits per minute, and revoking the key or disconnecting the client closes the connection within a minute.

Three ways: sign out of the app in your Cloud Browser, which works from the next call; press Disable for agents next to the app, which keeps you signed in; or Reset browser in Settings, which deletes the whole profile. Closing your Cotlet account deletes the browser too.

The key holds no cookies or logins, it only asks Cotlet to run a tool. It reaches only the apps and tools you gave it, and anything that reaches other people, like posts or messages, waits for your OK by default. Every call is in your activity log, and deleting the key ends access at once.

Take Group sp. z o.o., a company registered in Poland, EU (VAT PL6342984273). Take Group has worked since 2019, runs about 3,200 websites on its own systems and has its own DevOps team for infrastructure security. Legal details are in the Terms of service.

Data passes through a call and is not retained. We keep no payloads after the call ends; your Background activity records each request's time, app, tool, address and status, without its content.

Your agent gets a link to your Cloud Browser and asks you to sign in to the app again; you also get an email. We never log in for you.

See status.cotlet.dev. An independent monitor, Better Stack, checks the website, console and API every 3 minutes from four continents, and every outage shows there in public.

In the European Union: the console, API, database and Cloud Browsers run in a data centre in Finland. Your browser reaches apps through an IP from our proxy provider, listed on the subprocessors page. Our CDN serves the public site worldwide. Finland is a Tier 1 country in the ITU Global Cybersecurity Index 2024.