Your code is the asset. We treat it that way.
What follows is specific on purpose. Where something is available rather than automatic, it says so — a security page you cannot check is not worth reading.
Where your code sits.
The two questions worth asking first, answered without hedging.
Isolation is a setting, and we will not imply otherwise
Every account is scoped to its organization: wallet, usage, retrieval index, conversations, designs and research runs are filtered by org on every read and write. Beyond that, an organization can be moved onto its own database schema — its own tables, not a shared one — or a dedicated deployment.
That stronger isolation is switched on per organization rather than granted by plan tier. If you need it, ask for it and we will confirm it is on before you put real code in.
Code that cannot leave, doesn't have to
We do not train models on your code or prompts. For work where that promise is not enough, Koda runs against a local model — Ollama or LM Studio on your own hardware — and self-hosts as a single container. Your code reaches no third-party inference provider at all.
It is the same product, routed differently. Nothing about the assistant is cut down to get there.
What is actually in place.
The controls a reviewer asks about, answered plainly.
Sessions and keys
Sign-in issues an opaque, server-side session cookie — no token is ever stored in your browser. The operator console and the customer app use separate cookies, so a session for one is not a session for the other. API keys are named and revocable from the dashboard.
Agent execution is sandboxed
Code the agent runs to verify its own work executes in a throwaway container with no network, all capabilities dropped and privilege escalation blocked. Commands are passed as arguments, never through a shell. Running anything on the host is refused unless explicitly enabled.
The agent stays in your workspace
When the CLI or the editor extension runs tools for the agent, every one of them — reads included — is checked against your workspace boundary. Writes and commands ask first; with nobody there to ask, they are denied rather than assumed.
Payments are verified, not trusted
Settlement callbacks are checked against the provider's signature before a wallet moves. Rails that cannot sign are restricted by source address and a secret in the callback path. Every credit is idempotent, so a replayed callback cannot pay twice.
Staff access is split and audited
Nobody is an operator by default. Support access and the ability to appoint staff or change platform pricing are separate tiers, so one compromised support session cannot mint more staff. Privileged actions are written to an audit log.
In transit and in the browser
TLS with HSTS. The dashboards are served under a strict Content-Security-Policy with no third-party scripts, fonts or images — everything is served from our own origin. Requests are rate-limited per client by default.
Where it runs, and what we don't have yet.
Residency
An organization can be pinned to a region, or run on your own infrastructure. Self-hosting is a supported path rather than a special case: the whole platform builds as one container image, so "it never leaves our network" is a deployment choice you can make on day one.
Reporting a vulnerability
Email [email protected]. We work with coordinated disclosure and will keep you updated while we fix it. If you are not sure whether something counts, send it anyway — we would rather read a false alarm than miss a real one.
Certifications: not yet, and we will not pretend otherwise
Koda Rising holds no security or privacy certification today. We are building toward the ones our fintech customers are asked for, and we would rather tell you that than let a badge on a marketing page do work it has not earned. If a certification is a hard requirement for you now, say so when you talk to us and we will tell you honestly where we are against it.
Last updated 30 August 2026.
Questions a page can't answer?
Send them to a person. We would rather have the conversation than write more copy.