Trust · Security · ComplianceBuilt for code your team can't afford to lose control of.

Codira treats your codebase like the most sensitive thing in your company — because for most teams, it is. This page lists exactly what we've built today, what's in progress, and what we'll never claim until it's real.

Single sign-on, roles and the audit log in a Codira IDE workspace, drawn from the product. Example content.

Today.The controls in place now.

Encryption at rest

Account data (sessions, plans, audit logs, billing references) lives in MongoDB Atlas, encrypted at rest by our infrastructure provider. Stripe handles all card data — Codira never sees or stores card numbers.

Encryption in transit

Traffic to codira.com and Codira's gateway is encrypted in transit (TLS) by our infrastructure provider, Render.

Authentication

Sessions use signed JWTs (jose, 7-day rotation). Enterprise + Team customers can require SAML 2.0 or OIDC SSO with replay protection. JIT user provisioning lands new SSO users directly into the right org.

Audit logging

Member invites, joins, removals and role changes, workspace changes, shared Architect doc and Team Memory edits, DPA and BAA requests, and SSO sign-ins are recorded in a per-workspace audit log. Teams keeps 90 days; Enterprise keeps full history.

Your code stays local

The desktop app doesn't upload your project. Codira's gateway stores no prompt or response content — only the model, tokens, cost and run ID for billing. Codira doesn't train on your code.

Least-privilege access

Staff access to production is restricted to a named engineering on-call rotation, gated behind hardware-key MFA, and recorded. No customer code is ever read by Codira staff in normal operation.

Compliance status.Where every certification stands.

  • SOC 2 Type I

    In progress

    Gap analysis complete · controls implementation underway · audit firm selected · target report Q4 2026.

  • SOC 2 Type II

    Planned

    Begins after Type I report lands · ~6 month observation window · target report H2 2027.

  • GDPR / DPA

    Available on request

    Data Processing Agreements available to Team and Enterprise customers on request. Standard contractual clauses included.

  • HIPAA / BAA

    Available on request

    Business Associate Agreements available to Enterprise customers on request. Required before processing PHI.

  • ISO 27001

    Planned

    On the roadmap after SOC 2 Type II — Enterprise customer demand will drive timing.

Need a signed DPA, BAA, or SOC 2 progress letter for your procurement team? Team and Enterprise customers can request these from Settings → Legal — or email security@codira.com.

Self-hosted.In early development.

A self-hosted gateway for Enterprise is in early development and is available by contract only. If you need it, talk to sales and we'll tell you where it stands.

Talk to sales

Reporting a vulnerability.Found something we should know about?

Send a clear write-up to security@codira.com. We acknowledge within one business day, target remediation timelines based on severity, and credit researchers who request it in the changelog. Coordinated disclosure preferred — please give us a window to fix before publishing.