Security and data handling
A practical overview of what Coagy stores and how coding agents run. Review this with your security team before connecting sensitive code.
Your workspace data
Prompts, agent messages, approvals, run events, summaries, diffs, and usage are stored in the workspace database. Agent session transcripts are separate and are not shared between computers in new workspaces by default; an owner can enable handoff memory.
Provider credentials
Provider keys are encrypted by the web server before they are stored. A key is sent to the selected runner for the run that uses it. Sharing a provider lets workspace teammates use that key and may incur charges on its owner’s provider account.
Agent execution
Runners execute tools and shell commands. Approval controls help a team review actions, but an approval prompt is not a security sandbox. Local runners can access resources available to the user account running them. The Docker worker is restricted, but teams should review its configuration and threat model before using sensitive repositories.
Workspace controls
Owners can restrict invitees by email domain, choose the invite-link role, require command approval, set a monthly estimated spend limit, and review or export recent administrative events.
Independent assurance
Coagy does not currently publish a SOC 2 or ISO certification, independent penetration-test report, or a standard DPA through this site. Do not treat this page as a compliance attestation.