Security and data
Access to your AWS account
- CoSell never holds AWS keys for your account. It assumes the role you created,
CoSellPlatformAccess-us-east-1, for up to 15 minutes at a time. - The role trusts only HabileLabs' platform role, and only with your workspace's external ID, which blocks the "confused deputy" problem.
- The role can use Partner Central Selling actions and read Partner Central. It can't touch any other AWS service. Delete the stack to revoke access at once.
Access to Zoho CRM
- You approve the scopes on Zoho's consent screen. The client secret and refresh token are stored in AWS Secrets Manager, encrypted, and never shown again.
- Access tokens are refreshed centrally and shared across CoSell's workers, within Zoho's limits.
- A daily call budget (Settings → General) caps how much of your Zoho API allowance CoSell may use.
What CoSell stores
| Data | Why | Kept |
|---|---|---|
| Opportunity mapping: IDs, statuses, the last payload sent to AWS | To send only real changes and show state | While the deal is tracked |
| AWS invitations | To answer referrals and meet the SLA | Until deleted with the workspace |
| Sync history and errors | Troubleshooting | Sync history 400 days; errors for the life of the workspace |
| Notifications | The bell and emails | 90 days |
| Assistant questions and answers | The conversation on the opportunity page | 48 hours |
| Audit log | Accountability | For the life of the workspace |
Deals themselves stay in Zoho. CoSell keeps only what it needs to sync them.
How it is protected
- Data is encrypted at rest (DynamoDB, Secrets Manager, S3) and in transit (TLS 1.2+).
- Each workspace's data is partitioned by tenant, and every API call is checked against the caller's membership and role.
- Sign-in uses Amazon Cognito, with invite-only accounts, a 12-character password minimum and optional multi-factor authentication.
- Every change and every call to AWS or Zoho is written to the audit log.
Where it runs
CoSell runs in HabileLabs' AWS account in us-east-1 (N. Virginia), where the Partner Central API is served. It uses API Gateway, Lambda, SQS, DynamoDB, EventBridge, Step Functions, S3, CloudFront, Cognito, Secrets Manager and SES.