Does coss.com support single sign-on?

Yes. An organization connects one OIDC or SAML identity provider for addresses on its verified domains, and owners can require SSO for every member. Owners keep break-glass access with their password. The pricing page lists the plans that include SSO.

Does coss.com support SCIM provisioning?

Yes. Directory sync adds, removes and promotes members from your identity provider, mapping groups to the admin or member role. It needs an SSO provider, and owners are never changed by the directory.

Can I require two-factor authentication for my team?

Yes. An organization can require two-factor authentication (an authenticator app with backup codes) for every member, and members without it are sent to set it up before they can continue. A session from the organization's own SSO provider also satisfies it, since the identity provider owns MFA.

How long does coss.com keep my data?

Each kind of data has a published period. Sent emails are kept for 45 days and received emails for 30, attachment bytes are deleted once a message is sent, and the worker deletes everything past its period. The data retention page lists every rule.

Is there an audit log?

Yes. The organization's audit log records every change made by members in the dashboard, by API keys and by coss.com support, with the target and the request id. Owners and admins filter and export it, and it can be read through the API.

Does coss.com have a data processing agreement?

Yes. The Data Processing Addendum is part of the Terms and is published at coss.com/legal/dpa, with its security measures and the list of subprocessors.

Built to be trusted with your users' data.

coss.com security covers who gets in and what is kept. SSO, SCIM, two-factor and passkeys, roles, an audit log, abuse screening and a retention policy.

Organizations decide how their members sign in, and coss.com enforces it on every page of the dashboard.

Single sign-on

Connect one OIDC or SAML identity provider for addresses on your verified domains. Owners can require SSO: members whose session didn't come from your provider are sent to sign in through it. Available on Scale and Enterprise. Single sign-on.

Directory sync

SCIM adds and removes members as your directory changes and maps groups to the admin or member role. Deactivating a user removes them and ends their SSO sessions; owners are never changed. Available on Enterprise. Directory sync.

Two-factor and passkeys

Members protect password sign-in with an authenticator app and backup codes, or sign in with a passkey that verifies the user. An organization can require two-factor for everyone, and sign-in forms are protected by Cloudflare Turnstile. Two-factor.

Roles

Members are owners, admins or members. Only owners change billing and require SSO; admins manage everything else. Members are read-only in the dashboard and create personal API keys where an owner or admin allows them. Members and roles.

Scoped API keys

Keys are bound to one environment with full, sending, read-only or custom permissions. Personal keys stop working when their member leaves, including when the directory removes them. API keys.

An audit log

Every change by a member, an API key or coss.com support, with its target, environment and request id. Filter and export it, read it with coss.auditEvents.list(), or stream it with a log drain. Available on Pro, Scale and Enterprise. Audit log.

Protecting every sender

Abuse by one sender hurts the deliverability of all of them. coss.com watches for it before mailbox providers and carriers do.

Reputation guard. Each organization has a standing, good, warning or suspended, measured from the bounce and complaint rates of its live email (and its SMS opt-outs and filtering) over a rolling window, with thresholds stricter than Amazon SES's. Owners and admins are emailed at a warning, and account.* webhooks tell your systems. A suspension stops live sending only, and is never lifted automatically: a person reviews it. Reputation.

Content screening. A sample of live emails and text messages is screened for spam, phishing, malware and fraud right before it is sent. Which messages are sampled can't be predicted, a sample that can't be screened is held rather than sent unscreened, and verdicts never store the content. Content screening.

Risk for your own product. The same signals protect your sign-ups and logins: Risk scores them and answers allow, review or block.

Data handling

What coss.com keeps, for how long, and how it is protected.

Every kind of data has a published retention period, enforced by the worker's purges and listed on the data retention page. A few of them:

Sent emails: kept 45 days
Attachment bytes: kept until the email is sent
Received emails: kept 30 days
Webhook deliveries: kept 30 days
Risk emails and IP addresses: kept 90 days
Content screening verdicts: kept 90 days

Encryption: data is encrypted in transit with TLS and at rest; webhook signing secrets and SMS provider credentials are also encrypted with AES-256-GCM, and passwords and API keys are stored only as hashes.
Less to keep: an environment can discard email content once it is sent. Risk remembers identifiers only as keyed hashes, and rate limit keys are stored hashed.
Clean logs: request logs never keep the Authorization header, secrets or attachment bytes, and error reports are scrubbed of bodies, IP addresses, cookies and query strings.
Isolation: every query is scoped to its organization, API keys are bound to one environment, and outbound webhooks reach public addresses only.

Legal

The documents your security review asks for, published.

The Data Processing Addendum is part of the Terms: it covers the security measures above, the subprocessors and their locations, and transfers under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses. The Privacy Policy and the Acceptable Use Policy say what coss.com collects and what it allows. Vulnerabilities can be reported through the responsible disclosure program at cal.com/security.

Plans

Which plans include the organization features.

Single sign-on is included in Scale and Enterprise; directory sync in Enterprise; the audit log in Pro, Scale and Enterprise; log drains in Scale and Enterprise. Two-factor, passkeys, roles, scoped keys, the reputation guard and the retention policy apply to every plan. See pricing.

Questions

Does coss.com support single sign-on?: Yes. An organization connects one OIDC or SAML identity provider for addresses on its verified domains, and owners can require SSO for every member. Owners keep break-glass access with their password. The pricing page lists the plans that include SSO.
Does coss.com support SCIM provisioning?: Yes. Directory sync adds, removes and promotes members from your identity provider, mapping groups to the admin or member role. It needs an SSO provider, and owners are never changed by the directory.
Can I require two-factor authentication for my team?: Yes. An organization can require two-factor authentication (an authenticator app with backup codes) for every member, and members without it are sent to set it up before they can continue. A session from the organization's own SSO provider also satisfies it, since the identity provider owns MFA.
How long does coss.com keep my data?: Each kind of data has a published period. Sent emails are kept for 45 days and received emails for 30, attachment bytes are deleted once a message is sent, and the worker deletes everything past its period. The data retention page lists every rule.
Is there an audit log?: Yes. The organization's audit log records every change made by members in the dashboard, by API keys and by coss.com support, with the target and the request id. Owners and admins filter and export it, and it can be read through the API.
Does coss.com have a data processing agreement?: Yes. The Data Processing Addendum is part of the Terms and is published at coss.com/legal/dpa, with its security measures and the list of subprocessors.

On the same key, SDK, webhooks and logs: nothing more to set up.

Start with Security today.

Development keys record every request and event and deliver nothing, so you can build and test before you verify a domain. Hand your coding agent this prompt:

Add coss.com to this project: read https://coss.com/llms.txt, get a development key with `npx coss-cli init --agents`, and build and test with it.