Security and data

#Access to your AWS account

• CoSell never holds AWS keys for your account. It assumes the role you created, CoSellPlatformAccess-us-east-1, for up to 15 minutes at a time.
• The role trusts only HabileLabs' platform role, and only with your workspace's external ID, which blocks the "confused deputy" problem.
• The role can use Partner Central Selling actions and read Partner Central. It can't touch any other AWS service. Delete the stack to revoke access at once.

#Access to Zoho CRM

• You approve the scopes on Zoho's consent screen. The client secret and refresh token are stored in AWS Secrets Manager, encrypted, and never shown again.
• Access tokens are refreshed centrally and shared across CoSell's workers, within Zoho's limits.
• A daily call budget (Settings → General) caps how much of your Zoho API allowance CoSell may use.

#What CoSell stores

Deals themselves stay in Zoho. CoSell keeps only what it needs to sync them.

An admin sets the three adjustable periods under Settings → Data & privacy → How long history is kept. Every day, CoSell deletes records older than the period, and a shorter period also applies to records already kept. Whatever the setting, each record also carries an expiry at the longest period allowed, as a backstop.

#How it is protected

• Data is encrypted at rest (DynamoDB, Secrets Manager, S3) and in transit (TLS 1.2+).
• Each workspace's data is partitioned by tenant, and every API call is checked against the caller's membership and role.
• Sign-in uses Amazon Cognito, with invite-only accounts, a 12-character password minimum and optional multi-factor authentication.
• Every change, every call to AWS or Zoho, and every AI request is written to the audit log.

#Exporting your data

An admin can export everything the workspace holds in CoSell under Settings → Data & privacy → Export all data:

• settings and members;
• the Zoho and AWS connections;
• every mapping version;
• opportunities and referrals;
• sync history and errors;
• the audit log, notifications and assistant questions;
• the daily adoption figures.

Credentials are never included: no Zoho client secret, refresh or access token, no Slack webhook, and no AWS role external ID.

The export takes a few minutes, and you get a notification when it is ready. It is one or more gzip-compressed JSON Lines files, one record per line with its kind, plus a manifest.json with counts and what was left out. Download links last 15 minutes, and the files are deleted after 7 days. Each download is recorded in the audit log. Exporting works even while the workspace is suspended or being deleted.

#Deleting your workspace

An admin can delete the workspace under Settings → Data & privacy → Delete this workspace. Type the workspace name to confirm. The workspace's admins are emailed at each stage.

1. Grace period (14 days). Nothing syncs, and Zoho stops notifying CoSell. AWS referrals that arrive are not processed. Everything stays readable, and you can still export it. Every page shows when the data will be deleted. Any admin can cancel the deletion. Cancelling resumes syncing, and CoSell catches up on what changed in Zoho CRM and Partner Central meanwhile.

2. Purge. After the grace period, CoSell:

   • revokes its Zoho CRM access at Zoho;
   • destroys the stored credentials (Zoho and Slack);
   • deletes the export files;
   • releases the AWS Marketplace customer account;
   • removes the event access of AWS accounts that no other workspace uses;
   • deletes every record the workspace held, the audit log included;
   • deletes the sign-ins of people who belong to no other workspace.

   The purge cannot be cancelled once it starts, and it usually takes minutes.

3. Afterwards. HabileLabs keeps a deletion receipt: the workspace ID, the dates, and how much each step removed. It holds no names and no email addresses. A day later a final pass removes anything that work already under way wrote after the purge. Copies in the platform's database backups age out within 35 days, and in its logs within 90 days.

What stays with you:

• The access role in your AWS account. Delete the CloudFormation stack you created from the onboarding template.
• The fields CoSell added to Zoho CRM Deals, and the values in them.
• Your opportunities in AWS Partner Central. They are AWS's records.
• Your AWS Marketplace subscription. Deleting the workspace does not cancel it; cancel it in AWS Marketplace. While a subscription is active, the delete form asks you to confirm that you understand this.

#AI features

CoSell's AI features advise and propose; none of them changes a deal by itself. Every change waits for a person (see Drafts and approvals).

• The quality coach suggests a rewrite of the customer business problem.
• Drafting proposes next steps and a summary from the deal, its notes and pasted meeting notes.
• The assistant answers questions about your pipeline with tools that read only your workspace.
• Ask Partner Central passes questions to the AWS Partner Central agent, which reads Partner Central with your AWS role. A change the agent proposes is declined, unless an admin chose to approve each one.

The coach, drafting and the assistant use Amazon Nova 2 Lite on Amazon Bedrock through the US inference profile, so a request can be served from us-east-1, us-east-2 or us-west-2. Pipeline health uses rules, not AI.

Every model request goes through a Bedrock guardrail. For the assistant, the guardrail checks your message; what its tools read is data, never instructions.

• Hateful, insulting, sexual, violent or criminal content is blocked.
• Attempts to override the coach's instructions are blocked.
• Profanity is filtered.
• AWS keys, passwords, card numbers and Aadhaar or PAN numbers are masked before the model sees them.

When the guardrail blocks something, CoSell says the suggestion or answer was withheld.

The audit log keeps each prompt and answer (up to 4,000 characters), the guardrail's decision, token use, the tools the assistant used, each Partner Central answer, and every decision on a proposal. They are deleted with the rest of the audit log. Amazon Bedrock does not use your prompts or answers to train models.

An admin can turn every AI feature off under Settings → General → AI assistance. The coach then scores by rules only; drafting, the assistant and Ask Partner Central are unavailable; pipeline health keeps working.

#Where it runs

CoSell runs in HabileLabs' AWS account in us-east-1 (N. Virginia), where the Partner Central API is served. It uses API Gateway, Lambda, SQS, DynamoDB, EventBridge, Step Functions, S3, CloudFront, Cognito, Secrets Manager, SES and Amazon Bedrock.