Your code is yours

Identity and access

Enterprise organisations sign in through their own identity provider. AI CodeOps supports SAML 2.0 and OpenID Connect, so Okta, Microsoft Entra ID, Google Workspace and other standard providers work. You verify the email domains you own, and people from those domains sign in through your provider, under its policies.

Inside AI CodeOps, access follows roles. Owners, admins, developers and viewers cover most teams; custom roles let you grant exactly the permissions a group needs. For separation of duties there are narrower administrative roles: a security admin manages SSO, policies, audit and approvals without touching billing or secrets, and a billing admin manages billing without reading code.

• SAML 2.0 and OIDC single sign-on, with verified domains
• Two-factor authentication with authenticator apps and passkeys
• Owner, admin, developer and viewer roles, custom roles, and separation-of-duties roles

Governance for AI-written code

The point of AI CodeOps is that AI can do the work without lowering the bar. Every change an agent proposes goes through a release gate before it can merge: the project's real tests have to pass, the AI review findings have to be reviewed, and the approvals your policies require have to be in place. Policies decide which changes need approval, for example changes to protected paths or to deployments, and once a workspace has two or more approvers, the person who asked for a change can't approve it alone.

Agents work inside limits you set. Workspace and per-workflow spend caps stop a runaway session before it spends more than you allowed, and every session shows what it cost. You can run sessions on the platform's models or connect your own model provider key, so prompts and code go to the provider your organisation has approved.

Audit trail and evidence

Everything that matters is recorded: sign-ins, membership and role changes, settings, approvals and their votes, policy decisions, and edits to AI-written code. The audit log is searchable by the people your roles allow.

For each change, AI CodeOps can produce a signed evidence pack: one file with the task given to the AI, the models that ran it, every approval and vote, the policy decisions, review findings, test results, a fingerprint of the diff, the pull request, the deployment and the matching audit entries. It is signed with the platform's Ed25519 key, so an auditor can check it was not altered, without an AI CodeOps account and even offline.

Security and isolation

The project's tests for an AI change, and every terminal, run in isolated sandbox containers with restricted network access. Workspaces are separated in the database by row-level security. Secrets and provider keys are encrypted at rest with AES-256-GCM, using a key kept outside the database. Software bill of materials records (CycloneDX and SPDX) are kept per project.

We don't claim certifications we don't hold: AI CodeOps is not SOC 2 or ISO 27001 certified today. A data processing agreement is available, and the subprocessors we use are listed on the trust page.

Self-hosted deployment (Enterprise only)

Some organisations need their code and run history to stay on their own infrastructure. For Enterprise customers, AI CodeOps can run in your own Kubernetes cluster, deployed with a Helm chart, with your own database, secrets store and model provider. Your data stays where you put it.

Self-hosted deployment is an Enterprise option, not a separate product: it is planned with you, and the installation guide is shared privately with customers. Contact sales to discuss it.

Support

Every workspace has Help built in: an assistant that answers questions from the documentation, and a way to open a ticket with our support team without leaving AI CodeOps. For Enterprise rollouts we work with your administrators on SSO setup, roles and policy design. Live service health is published on the status page, and the changelog lists every notable change, so your administrators always know what changed and when.

Rolling out

Most teams start in the open beta on the hosted platform with one project, connect their Git host (GitHub, GitLab, Bitbucket, Gitea or Forgejo, including self-hosted instances), and tune the gates and policies there. When you're ready to bring in the wider organisation, we set up SSO, roles and policies with you and agree per-seat pricing.

FAQ