Security.Trust is engineered, not assumed.
At Codira, security is part of how the software is designed: what AI can reach, what it can change and who decides. Statements on this page describe how the products work today.
Our approach.Four controls every product shares.
Contained by Design
Checks in Code
People Decide
A Record of What Happened
By product.How each one handles data and access.
Codira IDE
What goes to the AI
The prompt and the code context a task needs go to the chosen model provider. The credits gateway stores token counts and cost, not prompts or responses.
Keys and sign-in
API keys, your sign-in and integration tokens are kept in the macOS Keychain.
Contained file access
The agents' file tools are confined to the project folder, and commands are classed as safe, needing approval or blocked.
Crash reports only
Anonymous crash reports, which you can turn off, and no usage analytics.
Codira PR
Isolation by organization
Row-level security is enforced on every table holding customer data, so one organization's records cannot be read by another.
Sign-in
Two-factor sign-in with recovery codes, which a workspace can require, and modern password hashing.
Audit trail
An append-only log of who did what, including any action by Codira staff in the customer's own log.
Uploads
Files are checked by type, scanned for malware before storage and served through short-lived signed links.
Codira ESQ
Privilege decided by counsel
Privilege and confidentiality classifications, including Attorneys' eyes only, are set by people. A flagged document cannot be produced.
Access and ethical walls
Per-case roles and ethical walls that also exclude screened documents from AI, with an append-only audit log.
Hosting and backups
Hosted in the United States, encrypted in transit and at rest by the hosting providers, with nightly backups kept for 35 days.
Leaving
After a subscription ends, the workspace stays readable for 30 days, and a full case export is available throughout.
What this page does not claim.Only what we can verify.
This page makes no claim of regulatory compliance, security certification or a completed third-party audit. When any of those is in place and verified, it will be stated here.
Each product’s own terms and privacy documents govern how its customer data is handled. Where this page and those documents differ, the product documents apply.
Report a vulnerability.Tell us what you found.
If you believe you have found a security issue in a Codira product or this site, please report it here rather than publicly.
- Give us reasonable time to fix it before you share it.
- Test only against accounts and data that are yours.
- Don’t degrade a service or access other people’s data.