What Cooper stores, and who else touches it.

Data handling

An account holds inboxes, messages (addresses, subject, text, HTML, extracted text), attachments, webhook URLs, and SHA-256 hashes of API keys and OAuth tokens. Cooper does not store the plaintext API key after the response that created it. Mailbox contents are not sold and are not used to train foundation models.

Retention

• Messages, attachments, inboxes, webhooks, and key hashes stay until you ask us to delete the account or an inbox.
• OAuth access tokens expire after 30 days. Refresh tokens expire after 90 days. Authorization codes expire after 10 minutes.
• Stripe customer and subscription ids stay with the account. Card numbers stay at Stripe. Cooper does not store a PAN.
• Platform logs at Vercel and Cloudflare follow those vendors’ retention. Cooper does not keep a separate IP table.

Encryption

The site and API are HTTPS. API keys and OAuth tokens are stored as SHA-256 hashes. Turso encrypts database files at rest as part of that service. Cooper does not add a separate application-layer encryption key over mailbox bodies. Webhook deliveries can be signed so a receiver can check they came from Cooper.

Subprocessors

These are the services the running stack uses:

• Vercel — hosts the website and API.
• Turso — production database (libSQL) for accounts, mail, and billing rows.
• Cloudflare — Email Routing for inbound, the inbound Worker, and Email Sending for outbound.
• Resend — optional outbound path when Cloudflare Email Sending is unavailable or when the operator selects it.
• Stripe — checkout, subscriptions, and the customer portal. Used when billing env vars are set.

SOC 2

Cooper does not have a SOC 2 report. A SOC 2 examination is on the roadmap. It is not scheduled as a completed audit, and this page will not claim a report that does not exist. AgentMail’s Startup plan lists a SOC 2 report; that is their statement, not ours.