Staff access policy
This policy says when CoDev staff may access your account, workspaces, code, chats and credentials, what we never do with them, and how we tell you. It forms part of our terms of service. The Security and privacy page lists what staff could technically reach today and how we are closing each path.
Who has access
- Administrators manage accounts, plans and credits from an internal console. It has no feature to open a workspace or view its name, repository, files, chats, terminals, members, credentials or environment variables, and it cannot sign in as you. Administrator status never makes anyone a member of your workspace.
- Operators are the few people who run CoDev's production infrastructure: the cloud account, the database and the encryption keys. We keep this group as small as running the service allows, require two-factor authentication on their accounts, and remove access when someone no longer needs it.
When operators may access your data
Operators may access workspace contents, chats or credentials only:
- to keep the service running or fix a fault that affects it;
- to investigate a security incident or abuse of the service;
- to meet a legal obligation, as described below; or
- when you ask us for help, with your permission and only as far as you agree.
Even then, we look at the least data needed, for the shortest time needed.
What we never do
- Read your code, chats or files out of curiosity, for product research or for any purpose not listed above.
- Use your content to train AI models, or let the AI providers we pay for train on what we send them.
- Sell your content or personal information, or use it for advertising.
- Show one customer's content to another.
- Sign in to your account as you.
Records and notice
Operators record every access to workspace contents, chats or credentials in an internal access log: who, when, which workspace or account, and why. If we access a workspace's contents for any reason other than its owner's own request, we email the owner within 7 days to say what we accessed and why. If the law forbids that, or telling you would harm an active investigation of abuse or a security incident, we tell you as soon as we are allowed.
Requests from governments and courts
We disclose customer data only in response to valid legal process, such as a subpoena, court order or warrant. We challenge requests that are unclear or overbroad, disclose only what the request requires, and tell the affected customer before disclosing unless the law forbids it. We publish the number of requests we receive each year.
Security incidents
If a security incident affects your data, we tell the affected account owners without undue delay, and no later than 72 hours after we confirm it, with what happened, what data was involved and what we are doing about it.
Running CoDev in your own cloud
Companies on Teams or Enterprise can run CoDev in a cloud account they own. CoDev staff keep no standing access to it; we act there only through access you grant for a specific task and revoke afterwards. See Run CoDev in your own cloud.
Changes
We will not reduce these commitments without emailing account owners at least 30 days before the change takes effect. Report a concern or a suspected breach of this policy to admins@trycodev.com.